What is the CVSS score of CVE-2025-21062?

CVE-2025-21062 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2025-21062?

Within 24 hours, inventory all Samsung Smart Switch installations and identify any version prior to 3.7.67.2; instruct users to avoid initiating restore operations from shared, untrusted, or unmanaged endpoints. Within 7 days, restrict Smart Switch restore capabilities to trusted administrators on trusted devices, require cryptographic verification of restore sources where possible, and enable logging and monitoring for unexpected application replacement or restore activity. Within 30 days, evaluate alternative device migration tools, enforce application allowlisting on connected mobile devices, and re-check the vendor advisory for a patch; if a vendor-released update to 3.7.67.2 or later becomes available, test and deploy it promptly. No vendor-released patch identified at time of analysis, so interim controls should remain in place until an update is validated.

Samsung Smart Switch CVE-2025-21062

HIGH

Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

2025-10-10 mobile.security@samsung.com

Information Disclosure Samsung Smart Switch

7.8

CVSS 3.1 · Vendor: samsung

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain local access to Samsung device
Exploit

Induce user to run Smart Switch restore
Execution

Exploit broken crypto to swap restoring application
Impact

Execute attacker-controlled application with high impact

Vulnerability Assessment

Weakness	CWE CWE-327 OWASP Top 10:2025 A04:2025 - Cryptographic Failures ASVS 5.0 V11 - Cryptography Approved algorithm selection
Exploitation Conditions	Requires local access to the device and user interaction: the victim must initiate/complete a Smart Switch restore operation, during which the broken or risky cryptographic algorithm (CWE-327) allows a local attacker to replace the application being restored. Affected only on Smart Switch versions prior to 3.7.67.2. Limiting factors that reduce real-world risk: the attack is local (AV:L), not remote; it cannot proceed without the user triggering the restore (UI:R); and it is constrained to the specific restore/transfer workflow rather than arbitrary runtime conditions.
Impact	Signals are mostly consistent and point to a genuine but non-urgent local vulnerability. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) describes a local attack requiring user interaction but no prior privileges, yielding high confidentiality/integrity/availability impact (7.8 HIGH) - the 'local + user interaction' combination inherently caps real-world mass exploitability. EPSS is very low at 0.10% (1st percentile), the CVE is NOT in CISA KEV, and no public POC is identified, so there is no evidence of active or widespread exploitation. No SSVC decision data was supplied. Net assessment: this is a legitimate security fix worth patching on Samsung mobile fleets, but it is a high-CVSS / low-real-world-risk item today rather than an emergency - the local attack vector and mandatory user interaction, combined with a 1st-percentile EPSS and absence of KEV/POC, argue for routine (not out-of-cycle) remediation. Note one conflict to verify: the input Tag 'Information Disclosure' does not match the described impact (replacement of the restoring application, i.e. integrity/code-execution), so treat that category label with caution.
Exploit ScenarioDerived	An attacker with local access to a Samsung device leverages the weak/broken cryptographic protection in Smart Switch to substitute a malicious application in place of the legitimate one being restored; when the victim performs or completes the Smart Switch restore operation (the required user interaction), the attacker-controlled application is installed/executed with high impact to confidentiality, integrity, and availability. No public exploit code has been identified at the time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 08, 2026

Local attackers can replace the application being restored by Samsung Smart Switch versions prior to 3.7.67.2 because the restore process uses a broken or risky cryptographic algorithm (CWE-327). The attack requires local access and user interaction to initiate a restore operation, and no public exploit has been identified at time of analysis; the EPSS score is 0.10% (1st percentile), indicating a low likelihood of exploitation. This is a genuine but non-urgent local vulnerability per independent assessment.

RemediationAI

Update Samsung Smart Switch to version 3.7.67.2 or later, as the vendor has released a patch for this issue. Until patched, avoid initiating Smart Switch restore operations when a malicious local actor could have access to the device, since the attack requires user interaction and local access. This mitigation reduces exposure but cannot eliminate risk if restore is necessary in an untrusted environment. Refer to the Samsung advisory at https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=10 for details.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Samsung Smart Switch is a utility for transferring data, applications, and settings between Samsung mobile devices. The vulnerability resides in the restore workflow, where the use of a broken or risky cryptographic algorithm (CWE-327) fails to adequately verify the integrity or authenticity of the application being restored. According to the CPE (cpe:2.3:a:samsung:smart_switch:*:*:*:*:*:*:*:*), all versions prior to 3.7.67.2 are affected. A local attacker (CVSS vector indicates PR:N, so unauthenticated) can exploit this only when the victim initiates a restore operation (UI:R), allowing the attacker to substitute a malicious application for the one being restored. The local attack vector (AV:L) and required user interaction constrain the attack to specific restore scenarios, rather than arbitrary runtime conditions.

Know when Smart Switch gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (samsung) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI 7.8 HIGH

Attack is local to the device (AV:L) with no prior privileges (PR:N) but requires the user to run a restore (UI:R); replacing the restored application yields full C/I/A impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (samsung).

CVSS VectorVendor: samsung

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.67.2 allows local attackers to replace the restoring application. User interaction is required for triggering this vulnerability.

Executive ViewAI

Why It Matters

Samsung Smart Switch versions prior to 3.7.67.2 contain a local cryptographic weakness in the restore process that could allow an attacker with local access and user interaction to replace an application being restored. This affects organizations that use Smart Switch on shared or untrusted endpoints, where a successful exploit could lead to unauthorized application installation or data integrity issues on connected devices. There is no public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis, so the immediate risk is limited but requires interim controls.

Business Impact: Medium

Compensating Controls

No vendor-released patch identified at time of analysis. Restrict use of Samsung Smart Switch to trusted local users and devices; verify integrity and provenance of restore sources; avoid initiating restores from untrusted media or shared workstations; monitor for anomalous restore or application replacement activity; apply vendor patch when available.

Threat Intelligence Overview

EPSS Score

0.1%

Top 99% exploitable

Prevalence

High

pre-installed data-transfer app on widely-used Samsung Galaxy mobile devices

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.