Galaxy Wearable CVE-2026-21013

Q: What is the CVSS score of CVE-2026-21013?

CVE-2026-21013 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21870 MEDIUM

Incorrect Default Permissions (CWE-276)

2026-04-13 SamsungMobile

GHSA-7c2r-j947-3p6p

Privilege Escalation Galaxy Wearable

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 13, 2026 - 06:29 vuln.today

CVSS changed

Apr 13, 2026 - 06:22 NVD

6.9 (MEDIUM)

EUVD ID Assigned

Apr 13, 2026 - 06:15 euvd

EUVD-2026-21870

Analysis Generated

Apr 13, 2026 - 06:15 vuln.today

CVE Published

Apr 13, 2026 - 05:04 nvd

MEDIUM 6.9

DescriptionCVE.org

Incorrect default permission in Galaxy Wearable prior to version 2.2.68.26 allows local attackers to access sensitive information.

AnalysisAI

Galaxy Wearable prior to version 2.2.68.26 allows local attackers to access sensitive information through incorrect default file or directory permissions, exposing high-value data on affected wearable devices. The vulnerability requires local access but no authentication or user interaction, making it exploitable by any user on the device.

Technical ContextAI

Galaxy Wearable is Samsung's companion application for smartwatches and wearable devices. The vulnerability stems from improper permission configuration (CWE root cause inferred as CWE-276: Incorrect Default Permissions) in files or directories that store sensitive data. On Android and wearable platforms, file permissions determine access control; incorrect defaults (e.g., world-readable, group-readable) allow unprivileged local processes or users to read protected information. The affected product spans all versions before 2.2.68.26 across the cpe:2.3:a:samsung_mobile:galaxy_wearable namespace, indicating a widespread permission issue likely in a shared library, cache, or credential storage mechanism.

RemediationAI

Update Galaxy Wearable to version 2.2.68.26 or later. Users should open the Galaxy Wearable application, navigate to the app settings or system app store (Samsung Galaxy Store or Google Play), check for available updates, and install the patched version. System administrators managing Samsung wearable fleets should verify rollout completion and confirm version numbers post-update. For details, refer to Samsung Mobile Security advisories at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=04.