Description Preview
Samsung Secure Folder contains an improper export of Android application components, resulting in an access control weakness that can let a local attacker access data stored within Secure Folder. This issue affects Secure Folder releases prior to 1.9.20.50 on Android 14, prior to 1.8.11.0 on Android 13, and prior to 1.7.04.0 on Android 12. An attacker with local access and no privileges can exploit the flaw with no user interaction to read data from Secure Folder, compromising confidentiality while having limited or no impact on integrity or availability. The fixed versions provide the remediation; users should update to the corresponding patched Secure Folder version for their Android release or apply available vendor security updates. If patching is not immediately possible, consider mitigating by temporarily disabling Secure Folder or restricting its usage, enabling strong device authentication, and applying applicable enterprise patch management measures.
Overview
CVE-2025-20897 describes an improper access control weakness in Samsung Secure Folder (CWE-926) that could allow a local attacker to access data stored inside the Secure Folder container. The vulnerability exists in older Secure Folder releases on Android 12, 13, and 14 and can be exploited without privileges or user interaction, leading to potential data exposure with high confidentiality impact. The issue is rated with a CVSS v3.1 base score of 6.8 (Medium) and is mitigated by upgrading to the specified patched versions for the respective Android release.
Remediation
- Upgrade to the patched Secure Folder version for your Android release:
- Android 14: 1.9.20.50 or newer
- Android 13: 1.8.11.0 or newer
- Android 12: 1.7.04.0 or newer
- Ensure the device receives the latest Android and Samsung security updates that include the Secure Folder patch.
- If immediate patching is not possible, temporarily disable Secure Folder or restrict access to it until a fix is applied.
- Enforce strong device authentication (screen lock, PIN/biometric) and minimize physical access to devices containing Secure Folder data.
- For enterprises, use mobile device management (MDM/EMM) to push updates and monitor patch status; follow Samsung advisories for any additional mitigations.
References
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Accommodation & Food ServicesAccommodation & Food Services: Low
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services: Low
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting: Low
- Arts, Entertainment & RecreationArts, Entertainment & Recreation: Low
- ConstructionConstruction: Low
- Educational ServicesEducational Services: Low
- Finance and InsuranceFinance and Insurance: Low
- Health Care & Social AssistanceHealth Care & Social Assistance: Low
- InformationInformation: Low
- Management of Companies & EnterprisesManagement of Companies & Enterprises: Low
- ManufacturingManufacturing: Low
- MiningMining: Low
- Other Services (except Public Administration)Other Services (except Public Administration): Low
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services: Low
- Public AdministrationPublic Administration: Low
- Real Estate Rental & LeasingReal Estate Rental & Leasing: Low
- Retail TradeRetail Trade: Low
- Transportation & WarehousingTransportation & Warehousing: Low
- UtilitiesUtilities: Low
- Wholesale TradeWholesale Trade: Low
