PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-1920 Samsung CVE debrief

CVE-2016-1920 describes a trust issue in Samsung KNOX 1.0.0 on Android where use of a shared certificate can allow a local user to carry out a man-in-the-middle attack. The NVD record classifies the issue as affecting Samsung Knox 1.0 and assigns a medium CVSS score (5.5) with high integrity impact. Because the attack requires local user interaction and is not a remote-only issue, the main concern is on devices where an attacker can operate locally or gain a foothold on the device.

Vendor
Samsung
Product
Knox
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Samsung KNOX 1.0.0 administrators, mobile device management teams, enterprise Android fleet operators, and users or support teams responsible for devices that may allow local installation of certificates or VPN profiles.

Technical summary

The supplied description states that Samsung KNOX 1.0.0 uses a shared certificate on Android, which can let a local user conduct man-in-the-middle attacks by installing a certificate and running a VPN service. NVD maps the affected product to cpe:2.3:a:samsung:knox:1.0 and lists CVSS 3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, indicating local access, no privileges, required user interaction, and primary integrity impact. NVD also lists CWE-284 (Improper Access Control).

Defensive priority

Medium. The issue is publicly disclosed and can undermine trust and traffic integrity on affected devices, but the supplied data does not indicate active exploitation or KEV inclusion.

Recommended defensive actions

  • Inventory devices using Samsung KNOX 1.0.0 and confirm whether they are still in service.
  • Apply vendor guidance or updates for affected Samsung KNOX deployments if available.
  • Restrict local access to managed Android devices, including physical access and opportunities to install untrusted certificates or VPN profiles.
  • Review installed certificate authorities and VPN configurations on affected devices for unexpected or user-added entries.
  • Remove or revoke untrusted certificates and profiles, and re-enroll devices if integrity of the trust store is uncertain.
  • Monitor mobile device management logs for certificate, VPN, or profile changes on affected fleets.

Evidence notes

The CVE description supplied in the corpus states that Samsung KNOX 1.0.0 uses a shared certificate on Android and that a local user can perform man-in-the-middle attacks by installing a certificate and running a VPN service. The NVD record confirms the affected CPE as Samsung Knox 1.0, gives the CVSS 3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, and identifies CWE-284. The provided reference URLs are SecurityFocus archive links cited by the CVE record.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-1920 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-1920

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-1920 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-1920

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.