Yes. CISA added CVE-2021-25394 to its Known Exploited Vulnerabilities catalogue on 29 June 2023, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.
What the KEV listing tells you about exploitation
The practical answer is that this is not a theoretical CVE, it is one CISA has already treated as actively exploited. That means defenders should assume public proof-of-concept code, weaponised exploit paths, or other reliable exploitation evidence may exist even if you have not seen an incident in your own environment.
For readers who want the authoritative source trail, check the CISA Known Exploited Vulnerabilities Catalog and the NIST National Vulnerability Database entry for the record details and reference data. CISA’s KEV status is the key signal here, while NVD is useful for the canonical identifier and supporting vulnerability metadata.
For mobile fleet owners, the important implication is exposure scope. If Samsung devices are in use anywhere in your estate, the question is not whether the vulnerability is “interesting”, but whether affected models, management profiles, and exposed device populations are present and reachable.
Why this vulnerability is operationally serious
The underlying flaw is a race condition in a low-level Android device component, the kind of bug that can become dangerous because timing-dependent weaknesses are hard to reason about and often difficult to reproduce in testing. The direct answer notes that exploitation can lead to a use-after-free and a write primitive once radio privilege is compromised, which raises the stakes from a simple crash issue to a potential post-compromise escalation path.
That combination matters because mobile endpoints often carry sensitive corporate access, tokens, and messaging, and they are frequently outside the strongest parts of the enterprise control stack. If an attacker can chain device-level exploitation with another foothold, the result can be persistence, credential theft, or broader access to enterprise services through the compromised phone.
For vulnerability triage and prioritisation, the most useful public reference is FIRST EPSS, which helps contextualise exploitation likelihood across known weaknesses. In practice, KEV status should outweigh generic scoring discussions when you are deciding what to fix first.
What to do if you cannot remediate immediately
If patching or device refresh is delayed, the goal is to reduce exposure, not to “monitor and hope”. Confirm which Samsung models, OS versions, and carrier-managed or BYOD devices are present, then isolate the subset that could plausibly be affected. Where enterprise mobility tooling exists, use it to narrow the blast radius with tighter app policy, enrollment enforcement, and device compliance rules.
The strongest adjacent control pattern is to review whether mobile device hardening, managed app policy, and selective wipe capability are actually enforced for business access. The Mobile Device Security Guide is useful here because the response is rarely only about one CVE, it is about whether the device estate is governed well enough to survive a known exploited flaw.
If the device may already have been compromised, preserve logs and investigate for suspicious enrollment changes, unusual privilege prompts, anomalous network behaviour, and any signs that enterprise accounts on the device were accessed from outside normal patterns. For mobile threats, device intelligence and fingerprinting can help distinguish normal device behaviour from a changed or spoofed device posture during investigation.
Risk and Threat Considerations
Actively exploited mobile vulnerabilities are especially dangerous because they sit at the intersection of endpoint reach, user trust, and delayed remediation. When the weakness can become a write primitive after privilege conditions are met, the main risk is not only initial compromise, but the possibility that an attacker can move from a single vulnerable device to account access, data exposure, or secondary abuse.
Failure mechanism: A timing-dependent race condition creates an unsafe memory state, which can be converted into a use-after-free and then a controlled write if the attacker reaches the right execution conditions.
Impact: The compromised device can become a foothold for privilege escalation, data theft, or follow-on access to enterprise resources tied to the phone.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Actively exploited CVEs require rapid exposure discovery and prioritised remediation. |
| CIS-12 — Network Infrastructure Management | Mobile endpoints need containment and policy enforcement when patching is delayed. | |
| Recommendation — Prioritise and remediate KEV-listed Samsung devices using continuous vulnerability management. Enforce mobile containment controls to reduce blast radius while remediation is pending. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | This CVE requires timely remediation of a known exploited software flaw. |
| RA-5 — Vulnerability Monitoring and Scanning | Confirm where exposed devices exist and whether they remain in vulnerable configurations. | |
| Recommendation — Track, patch, and verify remediation for the affected Samsung mobile software flaw. Scan managed mobile assets to identify and verify exposure to the exploited vulnerability. | ||
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | If the device is compromised, stored credentials and tokens on the phone can extend impact. |
| Recommendation — Rotate any secrets stored or accessed on potentially compromised mobile devices. | ||
Practitioner Guidance
What to verify: Confirm whether Samsung mobile devices are present in your inventory, whether they are managed, and whether any business-critical access depends on them. If you cannot identify the population quickly, treat that as a visibility gap that should be closed before the next patch cycle.
Decision rule: If a device is in scope for corporate email, messaging, VPN, or privileged app access, prioritise isolation and remediation over waiting for evidence of abuse. If the device is unmanaged or cannot be validated, treat it as higher risk than a well-instrumented managed endpoint.
Practitioner takeaway: KEV inclusion means the question has already moved past “could it be exploited?” into “how quickly can we find exposure, contain it, and prove the device did not become an access path?”