CVE-2022-30750: 
NixOS vulnerability analysis and mitigation

Improper access control vulnerability in updateLastConnectedClientInfo function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker to access wifi ap client mac address that connected (NVD). The vulnerability was discovered and disclosed in 2022, affecting Samsung mobile devices running Android versions 10.0, 11.0, and 12.0 (NVD).

The vulnerability is classified as an improper access control issue (CWE-284) with a CVSS v3.1 Base Score of 3.3 LOW (Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The vulnerability exists in the updateLastConnectedClientInfo function of SemWifiApClient component, which fails to properly restrict access to wifi access point client MAC addresses (Samsung Mobile).

If exploited, the vulnerability allows attackers to access MAC addresses of clients that have connected to the WiFi access point. This could potentially lead to privacy concerns as MAC addresses can be used to track devices (NVD).

The vulnerability requires local access with low privileges to exploit. The attack complexity is low, and no user interaction is required. However, the scope is unchanged, meaning the impact is limited to the vulnerable component (NVD).

Samsung addressed this vulnerability in the SMR Jul-2022 Release 1 security update by adding proper access control logic to prevent unauthorized access to WiFi client MAC addresses (Samsung Mobile).