EUVD-2026-12325Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAdjacent attacker crafts malicious path traversal input
-
ExploitSmart Switch processes request with user interaction
-
ExecutionArbitrary file overwrite with elevated privileges
-
ImpactSystem compromise via modified configuration or binaries
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Smart Switch prior to version 3.7.69.15 must be installed. Attacker must be adjacent (local network) to the target system. User interaction required to trigger the vulnerable path traversal function. |
| Impact | CVSS 7.1. EPSS 0.0%. No patch confirmed. |
| Exploit ScenarioDerived | An attacker could manipulate file path parameters in Smart Switch to read or write files outside the intended directory, potentially accessing sensitive configuration or credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
A path traversal vulnerability in Smart Switch (CVSS 7.1) that allows adjacent attackers. High severity vulnerability requiring prompt remediation.
Earlier versions of this analysis (1)
Path traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite arbitrary files with Smart Switch privilege.
RemediationAI
Monitor vendor channels for patch availability.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Vulnerability type: path traversal. CVSS 7.1 indicates high severity. Affects Smart Switch.
Know when Smart Switch gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Path traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite arbitrary files with Smart Switch privilege.
Executive ViewAI
Samsung Smart Switch contains a path traversal vulnerability allowing network-adjacent attackers to overwrite arbitrary files without authentication, potentially compromising system integrity and enabling malicious code injection. Organizations using Smart Switch versions prior to 3.7.69.15 face immediate risk of data corruption and system compromise, with no available patch currently forcing reliance on interim controls.
Network segmentation: restrict Smart Switch communications to trusted internal networks only; disable or uninstall Smart Switch on non-critical systems; implement file integrity monitoring (FIM) on system directories to detect unauthorized writes; configure firewall rules to block Smart Switch traffic from untrusted sources; maintain frequent system backups to enable rapid recovery from file corruption; monitor for suspicious file modification activities in system directories. No vendor patch available—prioritize vendor remediation tracking.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Related Vulnerabilities in Samsung Smart Switch Authentication Bypass
View all 7More in Smart Switch
View allLocal attackers can replace the application being restored by Samsung Smart Switch versions prior to 3.7.67.2 because th
Unencrypted data transmission in Samsung Smart Switch prior to version 3.7.72.6 exposes sensitive personal data to inter
Cleartext storage of sensitive information in Samsung Smart Switch prior to version 3.7.72.6 exposes device migration da
Samsung Smart Switch prior to version 3.7.72.6 exposes sensitive user data to adjacent network attackers through imprope
Improper authentication in Samsung Smart Switch before version 3.7.66.6 lets an attacker who shares the same adjacent ne
Use of insufficiently random value of secretKey in Smart Switch prior to version 3.7.68.6 allows adjacent attackers to a
Samsung Smart Switch stores sensitive information in cleartext on the local filesystem prior to version 3.7.67.2, allowi
Samsung Smart Switch before version 3.7.67.2 stores sensitive application backup data in cleartext, enabling a local att
GitHub PoC
Exploit-DB