What is CVE-2022-28793?

CVE-2022-28793 is a medium-severity vulnerability in Samsung Galaxy S22, classified under Improper Check for Unusual or Exceptional Conditions. CVSS score: 4.4/10. Published 2022-05-03.

How severe is CVE-2022-28793?

Medium severity. CVSS v3 base score is 4.4 out of 10.

Vulnerability in Samsung Galaxy S22

CVE-2022-28793

Given the TEE is compromised and controlled by the attacker, improper state maintenance in StrongBox allows attackers to change Android ROT during device boot cycle after compromising TEE. The patch is applied in Galaxy S22 to prevent change of Android ROT after first initialization at boot time.

EPSS: 0.002 (11.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N.

Affected products

Weakness classification (CWE)

CWE-754 — Improper Check for Unusual or Exceptional Conditions

References

mobile.security@samsung.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2022-28793?: CVE-2022-28793 is a medium-severity vulnerability in Samsung Galaxy S22, classified under Improper Check for Unusual or Exceptional Conditions. CVSS score: 4.4/10. Published 2022-05-03.
How severe is CVE-2022-28793?: Medium severity. CVSS v3 base score is 4.4 out of 10.