What is CVE-2025-2233?

CVE-2025-2233 is a high-severity vulnerability in Samsung Smartthings, classified under Improper Verification of Cryptographic Signature. CVSS score: 8.8/10. Published 2025-03-11.

How severe is CVE-2025-2233?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2025-2233 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Samsung Smartthings

CVE-2025-2233

Samsung SmartThings Improper Verification of Cryptographic Signature Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Samsung SmartThings. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Hub Local API service, which listens on TCP port 8766 by default. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25615.

EPSS: 0.007 (50.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Samsung Smartthings — versions 000.054.00013

Weakness classification (CWE)

CWE-347 — Improper Verification of Cryptographic Signature

Public proof-of-concept exploits

References

zdi-disclosures@trendmicro.com (x_research-advisory, Third Party Advisory)

Frequently asked questions

What is CVE-2025-2233?: CVE-2025-2233 is a high-severity vulnerability in Samsung Smartthings, classified under Improper Verification of Cryptographic Signature. CVSS score: 8.8/10. Published 2025-03-11.
How severe is CVE-2025-2233?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2025-2233 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.