Bishop Fox researchers disclosed CVE-pending SVE-2025-50109, an arbitrary command injection vulnerability (CWE-78) in Samsung's Tizen OS through version 9.0, affecting the Samsung Debug Bridge (SDB) service used for developer mode. By crafting malicious package names or filenames containing shell metacharacters and passing them through sdb install or sdb shell commands, an attacker could bypass Samsung's OS shell restrictions and achieve OS-level code execution. Exploitation requires developer mode enabled and physical proximity or access from the configured host IP, limiting opportunistic abuse, but the flaw was confirmed on physical TVs running Tizen 5.5, 7.0, and 8.0, and emulated 9.0. Samsung acknowledged the issue; no patch was available at disclosure time, and Bishop Fox recommends kiosk mode and disabling developer mode on publicly deployed TVs.
Questions this post answers
What is CVE SVE-2025-50109 in Samsung Tizen OS?
SVE-2025-50109 is a command injection vulnerability (CWE-78) in the Samsung Debug Bridge (SDB) service on Tizen OS through version 9.0. It allows execution of arbitrary OS-level commands by embedding shell metacharacters in package names used with sdb install or sdb shell, provided developer mode is enabled and the attacker connects from the configured developer-mode host IP. Track emerging CVEs like this one for connected devices you manage by following security research on daily.dev.
Which Samsung smart TV models were confirmed vulnerable to the Tizen SDB command injection bug?
Bishop Fox confirmed exploitation on three physical Samsung smart TVs: a 2020 43-inch UN43TU700DFXZA running Tizen 5.5, a 2022 55-inch UN55CU7000 running Tizen 7.0, and a 2024 55-inch QN55Q60DAFXZA running a 2025 build of Tizen 8.0. Tizen 9.0 was also confirmed vulnerable via emulation, and all Tizen versions supporting the SDB developer tool are believed likely affected. Developers assessing device security exposure can follow disclosures like this on daily.dev.
How can I protect Samsung smart TVs from the Tizen developer mode command injection vulnerability?
Update the TV once Samsung releases a patch, and place TVs deployed in public or semi-public locations into kiosk mode to prevent access to developer tools. Disabling developer mode and restricting network access to the configured host IP also reduces exposure, since exploitation requires developer mode enabled and proximity or access from that specific IP. Security teams hardening shared and public device deployments can find guidance like this on daily.dev.