Improper access control

Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing login activity...

Spoofing

PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via implicit Intent...

CVE-2022-30749

CVE-2022-30749 affects Samsung SmartThings prior to version 1.7.85.25. The issue is improper access control that allows local attackers to bypass login and add arbitrary devices. Root cause: inadequate access control checks in the login/authorization flow. Impact: local attacker can extend device...

CVE-2022-30749

Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing login activity...

CVE-2022-30747

The CVE-2022-30747 issue affects Samsung SmartThings on Android, where a PendingIntent hijacking vulnerability in the app allows a local attacker to access files via an implicit Intent. Impact is realized if using versions prior to Samsung SmartThings 1.7.85.25; the documents indicate this fix ve...

CVE-2022-30747

PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via implicit Intent...

CVE-2022-30746

Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript interface API...

CVE-2022-30746

Summary: CVE-2022-30746 affects Samsung SmartThings prior to 1.7.85.12. A missing caller check in the JavaScript interface API can allow a remote attacker to access sensitive information. The vulnerability is described across multiple sources (NVD, Red Hat, CNVD/CNNVD references) as a missing cal...