U.S. CISA adds Samsung mobile devices flaw to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Samsung mobile devices flaw, tracked as CVE-2025-21042 (CVSS 8.8), to its Known Exploited Vulnerabilities catalog. The flaw was exploited as a zero-day to deploy LANDFALL spyware in targeted Middle East attacks, with the campaign delivering malware in DNG image files sent via WhatsApp and targeting flagship Galaxy models (S22–S24, Fold4, Flip4).

According to Palo Alto Networks Unit 42, the researchers uncovered a previously unknown Android spyware family and noted that the vulnerability was actively exploited in the wild months before Samsung patched it in April 2025. The LANDFALL campaign used a zero-click chain to install itself, with two components dropped—b.so and l.so—and communicated with six known C2 servers across Europe.

The researchers linked its infrastructure patterns to Stealth Falcon (FruityArmor) but could not attribute it to a specific threat actor, and they emphasised the need for organisations to review the KEV Catalog and address the vulnerability ahead of the December 1, 2025 deadline.