Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Improper verification of intent by broadcast receiver in Samsung Flow prior to version 4.9.17.6 allows local attackers to modify Samsung Flow configuration.

CVE-2025-20972 is a medium-severity vulnerability identified in Samsung Flow, a software product by Samsung Mobile that facilitates seamless connectivity and data transfer between Samsung mobile devices and PCs. The vulnerability stems from improper verification of intent by a broadcast receiver component within Samsung Flow versions prior to 4.9.17.6. Broadcast receivers in Android listen for system-wide or application-specific intents to trigger certain actions. Improper verification means that the broadcast receiver does not adequately validate the source or content of incoming intents, allowing a local attacker to send crafted intents that can manipulate the application's configuration. This vulnerability does not require privileges or user interaction, making it easier for a local attacker to exploit. The CVSS 3.1 score is 6.2 (medium), with the vector indicating local attack vector (AV:L), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), no confidentiality or integrity impact (C:N, I:N), but high impact on availability (A:H). This suggests that exploitation could disrupt Samsung Flow's availability or functionality, potentially causing denial of service or configuration corruption. No known exploits are reported in the wild, and no patches are linked yet. The vulnerability is classified under CWE-925, which relates to improper verification of intent, a common Android security weakness that can lead to unauthorized application behavior manipulation.

Detailed information about CVE-2025-20972: CWE-925: Improper Verification of Intent by Broadcast Receiver in Samsung Mobile Samsung Flow affecting Samsung Mobil

CVE-2025-20972: CWE-925: Improper Verification of Intent by Broadcast Receiver in Samsung Mobile Samsung Flow - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-20972: CWE-925: Improper Verification of Intent by Broadcast Receiver in Samsung Mobile Samsung Flow

Improper verification of intent by broadcast receiver in UnifiedWFC prior to SMR May-2025 Release 1 allows local attackers to manipulate VoWiFi related behaviors.

CVE-2025-20958 is a medium-severity vulnerability identified in Samsung Mobile Devices, specifically affecting the UnifiedWFC component prior to the SMR (Security Maintenance Release) May-2025 Release 1. The vulnerability is categorized under CWE-925, which pertains to improper verification of intent by a broadcast receiver. Broadcast receivers in Android are components that listen for system-wide or application-specific broadcast messages (intents). In this case, the UnifiedWFC broadcast receiver fails to properly verify the authenticity or intent of incoming broadcast messages. This flaw allows a local attacker—someone with limited access to the device—to manipulate Voice over Wi-Fi (VoWiFi) related behaviors. VoWiFi is a feature that enables voice calls over Wi-Fi networks instead of cellular networks, often used to improve call quality or coverage indoors.

The vulnerability has a CVSS 3.1 base score of 4.4, indicating a medium level of severity. The vector string (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) reveals that the attack requires local access (AV:L), low attack complexity (AC:L), and low privileges (PR:L), but no user interaction (UI:N). The impact affects integrity and availability but not confidentiality. Specifically, an attacker could alter the behavior of VoWiFi services, potentially causing service disruption or manipulation of call routing or quality, but without direct data leakage.

No known exploits are currently reported in the wild, and no patches or updates have been linked yet. The vulnerability was reserved in November 2024 and published in May 2025, indicating recent discovery and disclosure. Since the flaw requires local access, exploitation would likely involve an attacker having physical access to the device or the ability to run code locally, such as through a malicious app or compromised user environment. The improper verification of intent suggests that the broadcast receiver does not adequately authenticate or validate incoming intents, allowing crafted intents to trigger unintended behaviors in the VoWiFi subsystem.

Detailed information about CVE-2025-20958: CWE-925: Improper Verification of Intent by Broadcast Receiver in Samsung Mobile Samsung Mobile Devices affecting Sam

CVE-2025-20958: CWE-925: Improper Verification of Intent by Broadcast Receiver in Samsung Mobile Samsung Mobile Devices - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'cwe-925'

Filter Threats

Threats Tagged 'cwe-925'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility