CVE-2025-21003: 
NixOS vulnerability analysis and mitigation

CVE-2025-21003 is an insecure storage of sensitive information vulnerability (CWE-922) in the Emergency SOS feature of Samsung Android devices. It allows local attackers with low privileges to access sensitive information stored by the Emergency SOS application. Affected versions include Samsung Android 13.0, 14.0, and 15.0 prior to the SMR Jul-2025 Release 1 patch. The vulnerability was published on July 8, 2025, with a patch released in the July 2025 Samsung Mobile Security Update. It carries a CVSS v3.1 base score of 5.5 (Medium) per NVD, though Samsung's own scoring assigns it a lower base score of 4.0 (Samsung Security, Red Hat CVE).

The root cause is classified as CWE-922 (Insecure Storage of Sensitive Information), meaning the Emergency SOS feature stores sensitive data in a location or manner accessible to other local processes or users without adequate access controls. The attack vector is local, requiring low privileges and no user interaction, with low attack complexity. An attacker with local access to the device can read sensitive information stored by the Emergency SOS component, potentially including personal or emergency contact data. No public technical write-ups or proof-of-concept code have been identified at this time (Samsung Security, ENISA EUVD).

Successful exploitation results in unauthorized disclosure of sensitive information stored within the Emergency SOS feature, with high confidentiality impact and no integrity or availability impact. A local attacker could access personal data such as emergency contacts or related configuration without requiring elevated privileges. The scope is limited to the affected device and does not directly enable lateral movement, but exposed data could be leveraged for social engineering or targeted attacks (ENISA EUVD, Samsung Security).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (ENISA EUVD, Red Hat CVE).

Samsung has released a patch in the SMR Jul-2025 Release 1 for Samsung Android devices running versions 13.0, 14.0, and 15.0. Users should apply the July 2025 Samsung security update as soon as it is available for their device. As interim mitigations, organizations should limit physical access to devices, ensure device encryption is enabled, and review Emergency SOS feature permissions where possible (Samsung Security).