CVE-2025-32407

Samsung Internet for Galaxy Watch version 5.0.9, available up until Samsung Galaxy Watch 3, does not properly validate TLS certificates, allowing for an attacker to impersonate any and all websites visited by the user. This is a critical misconfiguration in the way the browser validates the identity of the server. It negates the use of HTTPS as a secure channel, allowing for Man-in-the-Middle attacks, stealing sensitive information or modifying incoming and outgoing traffic. NOTE: This vulnerability is in an end-of-life product that is no longer maintained by the vendor.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/diegovargasj/CVE-2025-32407	Exploit

Configurations

Configuration 1 (hide)

cpe:2.3:a:samsung:internet:5.0.9:*:*:*:*:*:*:*

History

12 Jun 2025, 16:30

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-16 21:15

Updated : 2025-06-12 16:30

NVD link : CVE-2025-32407

Mitre link : CVE-2025-32407

CVE.ORG link : CVE-2025-32407

JSON object : View

Products Affected

samsung

internet

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2025-32407", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2025-05-16T21:15:35.093", "references": [{"url": "https://github.com/diegovargasj/CVE-2025-32407", "tags": ["Exploit"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "Samsung Internet for Galaxy Watch version 5.0.9, available up until Samsung Galaxy Watch 3, does not properly validate TLS certificates, allowing for an attacker to impersonate any and all websites visited by the user. This is a critical misconfiguration in the way the browser validates the identity of the server. It negates the use of HTTPS as a secure channel, allowing for Man-in-the-Middle attacks, stealing sensitive information or modifying incoming and outgoing traffic. NOTE: This vulnerability is in an end-of-life product that is no longer maintained by the vendor."}, {"lang": "es", "value": "Samsung Internet para Galaxy Watch versi\u00f3n 5.0.9, disponible hasta el Samsung Galaxy Watch 3, no valida correctamente los certificados TLS, lo que permite a un atacante suplantar la identidad de todos los sitios web visitados por el usuario. Esto representa un error cr\u00edtico en la forma en que el navegador valida la identidad del servidor. Impide el uso de HTTPS como canal seguro, lo que permite ataques de intermediario (Man-in-the-Middle), el robo de informaci\u00f3n confidencial o la modificaci\u00f3n del tr\u00e1fico entrante y saliente. NOTA: Esta vulnerabilidad se encuentra en un producto al final de su vida \u00fatil que ya no recibe mantenimiento del proveedor."}], "lastModified": "2025-06-12T16:30:02.260", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:samsung:internet:5.0.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ABBFBB1B-77E7-4D11-B90D-13D3065B04B9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}