EUVD-2026-34804
GHSA-57x5-6c8x-j77q
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (SamsungMobile) · only source for this CVE.
CVSS VectorVendor: SamsungMobile
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Improper export of android application components in SmartHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script.
AnalysisAI
Improper export of the SmartHomeWidgetReceiver Android component in Samsung Assistant prior to version 9.3.14 allows a local attacker without any privileges to send crafted intents directly to the exposed receiver and execute arbitrary scripts. The CVSS 4.0 score of 6.9 reflects high confidentiality impact (VC:H) constrained to the local attack surface (AV:L), aligning with the 'Information Disclosure' tag. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Technical ContextAI
This vulnerability involves an improperly exported Android BroadcastReceiver component named SmartHomeWidgetReceiver within Samsung Assistant. In Android, BroadcastReceiver components declared as exported without adequate permission enforcement are accessible to any other application on the device - any app can broadcast an intent targeting that component. The affected product is identified by CPE cpe:2.3:a:samsung_mobile:samsung_assistant:*:*:*:*:*:*:*:*, covering all versions prior to 9.3.14 on Android. No CWE was formally assigned, but the root cause aligns with CWE-926 (Improper Export of Android Application Components), which describes the class of vulnerabilities where Android components are accessible to untrusted callers beyond their intended scope due to missing or insufficient export restrictions or permission declarations in the AndroidManifest.
RemediationAI
The primary fix is to update Samsung Assistant to version 9.3.14 or later, which resolves the improper component export as confirmed by the Samsung Mobile Security advisory at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=06 and EUVD-2026-34804. Vendor-released patch: 9.3.14. As a compensating control prior to patching, restricting installation of untrusted or sideloaded third-party applications using Android Enterprise policies or device management (MDM/EMM) reduces the risk of a malicious app invoking the exposed receiver - this does not eliminate the vulnerability but raises the attacker's required access bar. If SmartHome widget functionality is not required in the deployment environment, disabling or restricting the SmartHome feature in Samsung Assistant may reduce the component's activation surface, though the specific configuration option is not detailed in available data and side effects on Samsung Assistant functionality should be assessed before applying.
Arbitrary file write as SYSTEM in Samsung MagicINFO 9 Server before version 21.1050 allows remote attackers to place att
Samsung MagicINFO 9 Server contains a path traversal vulnerability allowing unauthenticated attackers to write arbitrary
Multiple stack-based buffer overflows in the BackupToAvi method in the (1) UMS_Ctrl 1.5.1.1 and (2) UMS_Ctrl_STW 2.0.1.0
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_u
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an un
Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive informat
Buffer overflow in the PrepareSync method in the SyncService.dll ActiveX control in Samsung Kies before 2.5.1.12123_2_7
The Samsung D6000 TV and possibly other products allow remote attackers to cause a denial of service (continuous restart
The Samsung D6000 TV and possibly other products allows remote attackers to cause a denial of service (crash) via a long
The ConnectDDNS method in the (1) STWConfigNVR 1.1.13.15 and (2) STWConfig 1.1.14.13 ActiveX controls in Samsung NET-i v
Multiple directory traversal vulnerabilities in Samsung SyncThru 6 before 1.0 allow remote attackers to delete arbitrary
Stack-based buffer overflow in the RequestScreenOptimization function in the XProcessControl.ocx ActiveX control in msls
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today