Samsung Mobile Devices CVE-2026-21003

Q: What is the CVSS score of CVE-2026-21003?

CVE-2026-21003 has a CVSS 4.0 base score of 5.2 (Medium). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21816 MEDIUM

2026-04-13 SamsungMobile

Authentication Bypass Samsung Mobile Devices

5.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.2 MEDIUM

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 13, 2026 - 05:28 vuln.today

CVSS changed

Apr 13, 2026 - 05:22 NVD

5.2 (MEDIUM)

EUVD ID Assigned

Apr 13, 2026 - 05:15 euvd

EUVD-2026-21816

Analysis Generated

Apr 13, 2026 - 05:15 vuln.today

CVE Published

Apr 13, 2026 - 04:57 nvd

MEDIUM 5.2

DescriptionCVE.org

Improper input validation in data related to network restrictions prior to SMR Apr-2026 Release 1 allows physical attackers to bypass the restrictions.

AnalysisAI

Improper input validation in Samsung Mobile devices prior to SMR April 2026 Release 1 allows physical attackers to bypass network restrictions without authentication. The vulnerability affects data handling related to network restriction policies, enabling unauthorized modification of network access controls. CVSS score of 5.2 reflects the physical attack requirement, though integrity and availability impacts are rated high for affected functions.

Technical ContextAI

This vulnerability stems from insufficient input validation in network restriction enforcement mechanisms within Samsung Mobile operating systems. The CVE targets policy data structures responsible for enforcing network access controls, likely in the Android framework or Samsung Knox security layer. Physical attack vector (AV:P) indicates the attacker requires direct device access to exploit the flaw, suggesting the vulnerability may involve bypassing boot-time verification, secure storage validation, or device configuration parsing. The CWE classification is not specified in available data, limiting identification of the exact validation class (e.g., CWE-20: Improper Input Validation, or CWE-434: Unrestricted Upload), but the mechanism involves manipulation of network restriction data prior to enforcement.

RemediationAI

Primary fix: Update affected Samsung Mobile devices to SMR April 2026 Release 1 or later, which contains the input validation correction for network restriction data. Consult Samsung's official security update bulletin at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=04 for exact version numbers, device compatibility, and over-the-air update availability. In interim, enforce strict physical device security controls including device lock policies, restricted physical access to devices, and endpoint management policies that prevent unauthorized configuration changes. Verify that network restriction policies are reapplied and validated after device updates to ensure enforcement integrity.

More in Samsung Mobile Devices

View all

CVE-2026-21019 HIGH This Week

8.6 May 13

Local privilege escalation in Samsung Galaxy Watch allows unprivileged local attackers to execute arbitrary code with sy

CVE-2026-21025 MEDIUM This Month

6.9 Jun 05

Incorrect privilege assignment in the Telephony component of Samsung Mobile devices prior to SMR Jun-2026 Release 1 perm

CVE-2026-21022 MEDIUM This Month

6.9 May 13

Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to acce

CVE-2026-21023 MEDIUM This Month

6.9 Apr 29

Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local att

CVE-2026-21018 MEDIUM This Month

6.8 May 13

Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary

CVE-2026-21012 MEDIUM This Month

6.8 Apr 13

External control of file name in Samsung AODManager prior to April 2026 SMR Release 1 allows privileged local attackers

CVE-2026-21015 MEDIUM This Month

6.8 May 13

Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique id

CVE-2026-21010 MEDIUM This Month

6.6 Apr 13

Improper input validation in Samsung Mobile Retail Mode prior to SMR April 2026 Release 1 allows local attackers with li

CVE-2026-21011 MEDIUM This Month

5.4 Apr 13

Bluetooth maintenance mode in Samsung Mobile devices prior to April 2026 SMR Release 1 permits physical attackers to byp

CVE-2026-21031 MEDIUM This Month

5.2 Jun 05

Improper authorization in Samsung's AppBlock application on Android 15 and 16 devices allows a local, low-privileged att

CVE-2026-21021 MEDIUM This Month

5.1 May 13

Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged act

CVE-2026-21008 MEDIUM This Month

5.1 Apr 13

Samsung Mobile S Share application prior to the April 2026 SMR Release 1 exposes sensitive information to adjacent netwo

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2017-10271 HIGH POC

7.5

CVE-2015-1427 CRITICAL POC

9.8

CVE-2025-3248 CRITICAL POC

9.8

CVE-2026-21003 vulnerability details – vuln.today

Back