SmartThings vulnerabilities

11 known vulnerabilities in SmartThings from Samsung. 11 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  SmartThings: Improper Verification of Cryptographic Signature

  CVE-2025-2233Mar 11, 2025Samsung

  Samsung SmartThings Improper Verification of Cryptographic Signature Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Samsung SmartThings. Authentication is not requ

• 7.5 High severity

  SmartThings: Exposure of Resource to Wrong Sphere

  CVE-2022-39871Oct 7, 2022Samsung

  Improper access control vulnerability cloudNotificationManager.java in SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcasts.

• 7.5 High severity

  SmartThings: Exposure of Resource to Wrong Sphere

  CVE-2022-39870Oct 7, 2022Samsung

  Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via PUSH_MESSAGE_RECEIVED broadcast.

• 7.5 High severity

  SmartThings: Exposure of Resource to Wrong Sphere

  CVE-2022-39869Oct 7, 2022Samsung

  Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via REMOVE_PERSISTENT_BANNER broadcast.

• 7.5 High severity

  SmartThings: Improper Access Control

  CVE-2022-39868Oct 7, 2022Samsung

  Improper access control vulnerability in GedSamsungAccount.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast.

• 7.5 High severity

  SmartThings: Improper Access Control

  CVE-2022-39867Oct 7, 2022Samsung

  Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via SHOW_PERSISTENT_BANNER broadcast.

• 7.5 High severity

  SmartThings: Improper Access Control

  CVE-2022-39866Oct 7, 2022Samsung

  Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast.

• 7.5 High severity

  SmartThings: Improper Access Control

  CVE-2022-39865Oct 7, 2022Samsung

  Improper access control vulnerability in ContentsSharingActivity.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast.

• 7.5 High severity

  SmartThings: Improper Access Control

  CVE-2022-39864Oct 7, 2022Samsung

  Improper access control vulnerability in WifiSetupLaunchHelper in SmartThings prior to version 1.7.89.25 allows attackers to access sensitive information via implicit intent.

• 7.8 High severity

  Smart Things: Improper Authentication

  CVE-2022-30749Jun 7, 2022Samsung

  Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing login activity.

• 7.5 High severity

  Smart Things: Missing Authorization

  CVE-2022-30746Jun 7, 2022Samsung

  Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript interface API.