How severe is CVE-2023-42571?

CVE-2023-42571 has a CVSS 3.x base score of 7.6, rated high severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2023-42571 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-42571?

CVE-2023-42571 affects Samsung Find My Mobile. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-42571?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2023-42571 published?

CVE-2023-42571 was published on 2023-12-05 and last updated on 2026-06-17.

CVE-2023-42571

CVE-2023-42571 is a high-severity vulnerability in Samsung Find My Mobile with a CVSS 3.x base score of 7.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 3.x base score 7.6)
EPSS exploit prediction: 0% (24th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Samsung Find My Mobile
Published: 2023-12-05
Last modified: 2026-06-17

Description

Abuse of remote unlock in Find My Mobile prior to version 7.3.13.4 allows physical attacker to unlock the device remotely by resetting the Samsung Account password with SMS verification when user lost the device.

Frequently asked questions

What is CVE-2023-42571?: Abuse of remote unlock in Find My Mobile prior to version 7.3.13.4 allows physical attacker to unlock the device remotely by resetting the Samsung Account password with SMS verification when user lost the device.
How severe is CVE-2023-42571?: CVE-2023-42571 has a CVSS 3.x base score of 7.6, rated high severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2023-42571 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-42571?: CVE-2023-42571 affects Samsung Find My Mobile. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-42571?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2023-42571 published?: CVE-2023-42571 was published on 2023-12-05 and last updated on 2026-06-17.

References

https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=12

Affected products (1)

cpe:2.3:a:samsung:find_my_mobile:*:*:*:*:*:*:*:*

More vulnerabilities in Samsung Find My Mobile

CVE-2022-33707 — Medium (CVSS 5.3): Improper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker to identify the device.
CVE-2022-36878 — Low (CVSS 3.3): Exposure of Sensitive Information in Find My Mobile prior to version 7.2.25.14 allows local attacker to access IMEI via…
CVE-2022-30742 — Low (CVSS 3.3): Sensitive information exposure vulnerability in FmmExtraOperation of Find My Mobile prior to 7.2.24.12 allows local…
CVE-2022-30741 — Low (CVSS 3.3): Sensitive information exposure vulnerability in SimChangeAlertManger of Find My Mobile prior to 7.2.24.12 allows local…

All CVEs affecting Samsung Find My Mobile →