CVE-2025-21032: Samsung Android Auth Bypass Vulnerability

CVE-2025-21032 Overview

CVE-2025-21032 is an improper access control vulnerability in Samsung's One UI Home launcher. The flaw affects Samsung Android devices running builds prior to the SMR Sep-2025 Release 1 security maintenance update. A physical attacker can bypass Kiosk mode under limited conditions, breaking out of the restricted single-app experience that administrators enforce on managed devices.

Kiosk mode is commonly deployed on point-of-sale terminals, information kiosks, corporate-managed handsets, and shared devices in retail or healthcare. Escaping this containment gives an adversary access to unauthorized launcher functions, apps, and data on the device.

Critical Impact
Physical attackers can bypass Samsung One UI Home Kiosk mode to reach unauthorized apps and data on managed Samsung Android 14 and 15 devices.

Affected Products

Samsung Android 14.0 builds prior to SMR Sep-2025 Release 1
Samsung Android 15.0 builds prior to SMR Sep-2025 Release 1
Samsung One UI Home launcher component on affected firmware

Discovery Timeline

2025-09-03 - CVE-2025-21032 published to the National Vulnerability Database
September 2025 - Samsung addresses the issue in the SMR Sep-2025 Release 1 security maintenance update
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-21032

Vulnerability Analysis

The vulnerability resides in One UI Home, the default Samsung launcher that also enforces the device Kiosk mode restrictions. Improper access control checks within the launcher permit specific interactions that were meant to be blocked while Kiosk mode is active. Once the restriction is circumvented, the attacker interacts with the device outside the intended single-app boundary.

Exploitation requires physical access to an unlocked, Kiosk-configured device and hands-on interaction with the user interface. No user credentials or elevated privileges are required for the attacker to trigger the bypass. Samsung classifies the issue as an access control weakness [NVD-CWE-noinfo] and remediated it through server-side Kiosk logic changes in the launcher.

Root Cause

The root cause is missing or incomplete authorization enforcement within Kiosk mode entry points exposed by One UI Home. Certain launcher pathways do not verify Kiosk state before performing sensitive UI transitions, allowing navigation outside the whitelisted application.

Attack Vector

The attack vector is physical (AV:P). An attacker with hands-on access to a Samsung Android device configured in Kiosk mode uses a specific sequence of interactions with the One UI Home launcher to escape the restricted environment. No network access, malware installation, or authentication is required. The bypass is constrained to "limited conditions," indicating a specific configuration or interaction sequence is needed.

See the Samsung Security Update September 2025 for advisory-level details.

Detection Methods for CVE-2025-21032

Indicators of Compromise

Managed Samsung devices in Kiosk mode showing unexpected app launches or navigation to the system launcher or settings screens
Mobile Device Management (MDM) logs recording Kiosk profile violations, unauthorized app foreground events, or launcher restarts on affected firmware
Device audit trails showing user interactions with One UI Home outside the whitelisted Kiosk application

Detection Strategies

Query MDM and Unified Endpoint Management (UEM) telemetry for Samsung Android 14 and 15 devices reporting firmware older than SMR Sep-2025 Release 1
Correlate physical access windows, such as unattended kiosk periods, with launcher events and Kiosk profile compliance failures
Baseline expected foreground application behavior on Kiosk devices and alert on deviations from the whitelisted app package

Monitoring Recommendations

Ingest Samsung Knox and MDM event streams into a centralized SIEM for continuous review of Kiosk compliance state
Monitor for repeated Kiosk exit attempts, screen unlock anomalies, and settings access on shared or public-facing devices
Track patch level distribution across the mobile fleet and alert when devices fall behind the September 2025 SMR baseline

How to Mitigate CVE-2025-21032

Immediate Actions Required

Apply the Samsung SMR Sep-2025 Release 1 security maintenance update to all affected Samsung Android 14 and 15 devices
Inventory Kiosk-configured devices through the MDM or Knox console and prioritize patch deployment for public-facing or shared devices
Physically secure Kiosk terminals with enclosures, tethering, or supervised placement until patching is complete

Patch Information

Samsung released the fix in the September 2025 Security Maintenance Release. Administrators should ensure devices report a build with SMR Sep-2025 Release 1 or later. Full advisory details are available in the Samsung Security Update September 2025.

Workarounds

Reduce unsupervised physical access to Kiosk devices through camera coverage, staff supervision, or physical mounts
Tighten Knox Kiosk profiles to further restrict UI elements, hardware buttons, and gesture navigation on affected firmware
Rotate any credentials, tokens, or session data that may have been reachable from a compromised Kiosk device pending remediation

bash

# Verify Samsung firmware security patch level on a managed device
adb shell getprop ro.build.version.security_patch
# Expected output: 2025-09-01 or later