Samsung Smart Switch CVE-2025-21060

Requires LOCAL access to the Samsung device running Smart Switch prior to version 3.7.67.2 (AV:L) and user interaction (UI:R) to trigger the vulnerable backup/transfer flow; the specific prerequisite is that Smart Switch writes application backup data to storage in cleartext (CWE-312), which a co-resident malicious app or a party with filesystem/physical access can then read. Limiting factors: no remote exploitation is possible, impact is confined to confidentiality (I:N/A:N), and the attacker must already be on the device and rely on the user initiating the backup operation - these constraints substantially reduce realistic risk below the raw install-base footprint.

This is a moderate-severity local information-disclosure issue with low real-world urgency as an active-exploitation priority, despite the broad install base. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N = 5.5) correctly caps severity at medium because exploitation is local (AV:L) and requires user interaction (UI:R) - an attacker cannot reach this remotely and must rely on the victim performing some action (e.g., initiating/restoring a backup or installing a malicious app that reads the data). EPSS is 0.10% (1st percentile), among the lowest possible, indicating no measurable likelihood of broad automated exploitation. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active exploitation or weaponization. The signals are internally consistent - low EPSS, local-only vector, confidentiality-only impact, and the self-reported nature (Samsung's own PSIRT) all point to a defense-in-depth hardening fix rather than an exploited-in-the-wild flaw. The one amplifying factor is prevalence: Smart Switch ships on Samsung Galaxy devices, so the affected population is large, which argues for patching via the normal Samsung security update cadence even though per-incident risk is low.

An attacker with local access to a Samsung device - for example, a malicious app installed on the same device or someone with brief physical/filesystem access - reads backup data that Smart Switch stored in cleartext, exposing other applications' sensitive data. Because UI:R applies, the attacker depends on the user triggering the vulnerable backup/transfer flow. No public exploit code is known at time of analysis.