Samsung Plus TV CVE-2026-21035

The Samsung Plus TV application must be actively running on the target device, satisfying the passive user interaction requirement (UI:P in CVSS 4.0). The attacker requires no authentication (PR:N) and no special configuration of the target beyond the application being in use. The network attack vector (AV:N) means the attacker must be able to reach the device over a network connection - exploitation is limited by whether the Samsung TV's network interface is accessible from the attacker's position (e.g., same LAN, or internet-exposed if not behind NAT). No specific non-default feature or protocol configuration is cited in the description as a prerequisite beyond the application running. The primary limiting factor is the passive user interaction requirement: exploitation cannot occur against an idle device where Samsung Plus TV is not active.

The CVSS 4.0 base score of 6.5 (Medium) initially appears moderate, but the vector decomposition demands closer scrutiny. Attack Vector Network (AV:N), Attack Complexity Low (AC:L), No Attack Requirements (AT:N), and No Privileges Required (PR:N) make initial access trivial for a network-positioned attacker. Passive user interaction (UI:P) is the only friction - the target device must simply be running the Samsung Plus TV application. The critical signal is the subsequent system impact: SC:H/SI:H/SA:H implies a fully compromised system scope beyond the app itself, which is disproportionate to the medium base score and warrants treatment closer to a high-severity finding in practice. EPSS data is not provided in the available intelligence; exploitation probability cannot be quantified. The CVE is not listed in CISA KEV, and no POC has been identified, suggesting no confirmed widespread exploitation. The risk is real but currently theoretical - the high system-scope impact makes prompt patching advisable before exploitation materializes.

An attacker on the same network segment - or reachable over the internet if the Samsung TV is not behind NAT/firewall - sends a crafted network request targeting the improper input validation flaw in Samsung Plus TV while a user passively operates the application. The malformed input bypasses validation checks, exposing sensitive information from the vulnerable component and potentially triggering cascading high-impact effects on the underlying TV system (SC:H/SI:H/SA:H). No public proof-of-concept code has been identified at time of analysis, so the precise input format required to trigger exploitation is not publicly documented.