Samsung Smart Switch CVE-2025-21061

Exploitation requires local access to the Samsung device or its storage (AV:L) and user interaction (UI:R) - the victim must perform the Smart Switch operation that writes sensitive data to cleartext storage before an attacker can read it. No authentication is required (PR:N), but there is no remote vector. Limiting factors: the attacker needs prior local/filesystem access, the triggering user action must occur, and affected installs are those running Smart Switch before version 3.7.67.2; impact is confined to disclosure of whatever sensitive data the app writes in plaintext (C:H only, no integrity/availability effect).

This is a low-to-moderate priority issue despite its MEDIUM CVSS 5.5 rating. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) describes a local-only vulnerability: an attacker must already have local access to the device and the victim must perform some action (UI:R) to trigger it. The only impact is confidentiality (C:H) via cleartext storage (CWE-312); there is no integrity or availability impact. Corroborating signals point to low real-world urgency: EPSS is 0.10% (1st percentile), there is no CISA KEV listing, and no public exploit code was identified. The signals are consistent rather than conflicting - a local attack vector, required user interaction, and very low exploitation probability all align with a non-urgent, difficult-to-weaponize local data-exposure bug rather than a mass-exploitation threat. Note: although PR:N indicates no authentication is required, the AV:L vector means an attacker must first obtain local access to the device/filesystem, which is the practical gating factor here.

An attacker with local access to a Samsung device (or its filesystem/backup) reads sensitive data that Smart Switch stored in cleartext, after the user performs an action such as running a data transfer or backup that writes the data. Because exploitation requires local access plus user interaction and only exposes data, it is opportunistic rather than remotely scalable. No public proof-of-concept was identified at time of analysis.