CVE-2018-10501 - CVE House
Back to Database
Status published High CVE-2018-10501

This vulnerability allows local attackers to escalate privileges on vulnerable...

Vulnerability Description

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Notes Fixed in version 2.0.02.31. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of ZIP files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the application. Was ZDI-CAN-5358.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-10501

Credits & Attribution

No credits recorded in the NVD database.

References

More from Samsung

View All →
CVE-2025-2233
Samsung SmartThings Improper Verification of Cryptographic Signature Authentication Bypass Vulnerability
High 8.8
CVE-2024-32670
Exposure of Sensitive Information to an Unauthorized Actor in Samsung...
High 7
CVE-2022-1230
This vulnerability allows local attackers to execute arbitrary code on...
Low 3.9
CVE-2020-8899
Memory corruption in Quram library when decoding qmg can lead to RCE
Critical 10
CVE-2020-8860
This vulnerability allows remote attackers to execute arbitrary code on...
High 7.1

Affected Vendor

Affected Software

Samsung Notes
Vulnerable Versions:
Fixed in version 2.0.02.31

Timeline

Official Publish: September 24th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact