CVE-2025-21013

Vulnerability

Overview

Improper access control in SemSensorManager for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information related to outdoor exercise and sleep time [1]. The root cause is missing or insufficient permission checks in the sensor manager component, enabling unauthorized read access to health-related telemetry.

Attack

Vector & Prerequisites

The attacker requires local access to the affected Galaxy Watch device (physical or paired Bluetooth). No elevated privileges or user interaction is needed beyond the initial access. The vulnerability can be exploited by a malicious app installed on the watch or through other local means [1].

Impact

A successful exploit allows the attacker to retrieve data such as outdoor exercise records, sleep duration, and related metrics. This represents a privacy violation, as the sensor data is intended to be protected from untrusted applications [1].

Mitigation

Samsung has addressed this issue in the SMR Aug-2025 Release 1 security update. Users are advised to update their Galaxy Watch firmware to the latest version available through Samsung Mobile Security [1].