CVE-2022-28793

low-risk
Published 2022-05-03

Given the TEE is compromised and controlled by the attacker, improper state maintenance in StrongBox allows attackers to change Android ROT during device boot cycle after compromising TEE. The patch is applied in Galaxy S22 to prevent change of Android ROT after first initialization at boot time.

Do I need to act?

-
0.06% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.4/10 Medium
LOCAL / LOW complexity

Affected Products (1)

Galaxy S22 Firmware

Affected Vendors

Samsung

References (2)

Vendor Advisory https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=5
Vendor Advisory https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=5
20
/ 100
low-risk
Severity 15/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal