« Back to list

CVE-2018-21038

Status: ModifiedCritical (9.8)—

An issue was discovered on Samsung mobile devices with N(7.x) software. The Secure Folder app's startup logic allows authentication bypass. The Samsung ID is SVE-2018-11628 (December 2018).

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Google — Android

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2018-21038",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-04-08T17:15:12.177",
  "references": [
    {
      "url": "https://security.samsungmobile.com/securityUpdate.smsb",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://security.samsungmobile.com/securityUpdate.smsb",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered on Samsung mobile devices with N(7.x) software. The Secure Folder app's startup logic allows authentication bypass. The Samsung ID is SVE-2018-11628 (December 2018)."
    },
    {
      "lang": "es",
      "value": "Se detectó un problema en dispositivos móviles Samsung con versión de software N(7.x). La lógica de inicio de la aplicación Secure Folder permite omitir la autenticación. El ID de Samsung es SVE-2018-11628 (Diciembre de 2018)."
    }
  ],
  "lastModified": "2026-06-17T01:54:00.653",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47"
            },
            {
              "criteria": "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC30B2A2-9674-4052-B402-20348E50F9E8"
            },
            {
              "criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C"
            },
            {
              "criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}