CVE-2025-20949 is a medium severity flaw (CVSS 5.1) in Samsung Members. Samsung rates it Moderate in its May 2025 bulletin as SVE-2024-0972. Update Samsung Members to 5.0.00.11 or later, or install the current version from the Galaxy Store or Play Store.
What's affected
- Product: Samsung Members
- Samsung bulletin ID: SVE-2024-0972, May 2025 update
- Fixed in: 5.0.00.11
- Reported to Samsung: 20 April 2024
- CVSS: 5.1 (Medium), vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Published: 2025-05-07
Samsung describes the issue as: path traversal in Samsung Members prior to version 5.0.00.11 allows attackers to read and write arbitrary file with the privilege of Samsung Members
Samsung says the patch adds proper input validation. It does not say the flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false for this CVE.
How to check if you're exposed
Check the installed app version on the phone or tablet.
- Open Settings, then Apps, then Samsung Members, and scroll to the version number.
- Compare it with 5.0.00.11. Anything older is affected.
- If you manage devices, pull the app version from your mobile device management console and filter for older builds.
From a computer with USB debugging enabled you can also read the version directly. The package name below is the one commonly used for this app, so confirm it on your device first.
adb shell dumpsys package com.samsung.android.voc | grep versionName
Keep in mind that the CVSS vector for this CVE is local with no privileges and no user interaction, so the main exposure is another app or process already running on the same device.
What to do now
- Update Samsung Members through the Galaxy Store or Play Store and confirm the version is 5.0.00.11 or later.
- Turn on automatic updates for Samsung apps so the next bulletin lands without anyone remembering to act.
- If you manage a fleet, report on app versions in your MDM and push the update to devices that lag.
- Review the rest of Samsung's May 2025 bulletin, because it lists other fixes for the same cycle.
Why it matters
The weakness is CWE-22, path traversal. The app builds a file path from outside input and does not confirm the result stays inside the folder it meant to use. Special path sequences then lead to files elsewhere on the device that the app itself is allowed to touch.
The impact is limited to what Samsung Members can read and write, which is why the score is 5.1. That is still worth fixing, because a read and write primitive inside an app can be chained with other problems. Samsung's fix adds input validation on the path.
Quick check
Is Samsung Members flaw exploited in the wild?
The CISA Known Exploited Vulnerabilities flag is false and Samsung's bulletin does not mention active exploitation.
Which version fixes it?
Samsung lists 5.0.00.11 as the resolved version. Anything older is affected.
Sources
Last reviewed: 19 October 2026.
