Samsung Mobile Devices CVE-2026-21011

Q: What is the CVSS score of CVE-2026-21011?

CVE-2026-21011 has a CVSS 4.0 base score of 5.4 (Medium). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21866 MEDIUM

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-04-13 SamsungMobile

Authentication Bypass Samsung Mobile Devices

5.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 13, 2026 - 06:29 vuln.today

CVSS changed

Apr 13, 2026 - 06:22 NVD

5.4 (MEDIUM)

EUVD ID Assigned

Apr 13, 2026 - 06:15 euvd

EUVD-2026-21866

Analysis Generated

Apr 13, 2026 - 06:15 vuln.today

CVE Published

Apr 13, 2026 - 05:04 nvd

MEDIUM 5.4

DescriptionCVE.org

Incorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Extend Unlock.

AnalysisAI

Bluetooth maintenance mode in Samsung Mobile devices prior to April 2026 SMR Release 1 permits physical attackers to bypass Extend Unlock authentication due to incorrect privilege assignment, enabling unauthorized device access without requiring prior authentication. The vulnerability requires physical proximity and user interaction but grants full confidentiality and integrity compromise of the device. No public exploit code has been identified at the time of analysis.

Technical ContextAI

The vulnerability resides in Samsung Mobile's Bluetooth stack implementation within maintenance mode functionality. Maintenance mode is a privileged operational state typically used for device diagnostics and service operations. The flaw involves improper privilege elevation or permission checks in the Bluetooth subsystem that fails to enforce proper authentication boundaries when processing Extend Unlock commands. This allows an attacker with physical access to the device and ability to trigger user interaction to assume elevated privileges normally reserved for authenticated users or administrators. The Bluetooth protocol layer does not properly validate privilege contexts before granting access to security-critical unlock mechanisms.

RemediationAI

Patch to Samsung Mobile devices updated with April 2026 SMR Release 1 or later. Users should visit https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=04 to identify their specific device model and download the latest firmware update. Pending patch application, restrict physical device access to trusted individuals, avoid entering maintenance mode on devices in untrusted environments, and ensure Bluetooth is disabled when the device is not in active use. For enterprise deployments, enforce strict physical security controls over devices and consider device management policies that restrict maintenance mode access or disable Bluetooth functionality in high-risk contexts.