SmartThingsKit CVE-2026-21050

Q: What is the CVSS score of CVE-2026-21050?

CVE-2026-21050 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-42820 MEDIUM

2026-07-10 mobile.security@samsung.com

GHSA-vp97-c768-8wqr

Information Disclosure

5.1

CVSS 4.0 · Vendor: samsung

Severity by source

Vendor (samsung) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.0 MEDIUM

Local-only vector with no privileges needed per CVSS 4.0 source data; scope unchanged and impact limited to low confidentiality with no integrity or availability effect.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (samsung).

CVSS VectorVendor: samsung

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 06:12 vuln.today

DescriptionCVE.org

Improper access control in SmartThingsKit prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information.

AnalysisAI

Improper access control in Samsung's SmartThingsKit component on Android 16 devices allows local attackers without elevated privileges to read sensitive information. The flaw, patched in SMR Jul-2026 Release 1, is limited to local exploitation and carries no integrity or availability impact. No public exploit has been identified at time of analysis, and Samsung has not reported active exploitation.

Technical ContextAI

SmartThingsKit is a Samsung-developed system component embedded in Samsung Mobile Devices running Android 16, providing integration with the SmartThings smart home ecosystem - including device discovery, credentials, and home network data. The root cause is improper access control, a class of flaws where a sensitive data store, content provider, broadcast receiver, or IPC endpoint fails to enforce adequate caller verification. Although no formal CWE was assigned, the CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) strongly suggests an unprotected Android IPC mechanism - such as an exported content provider or intent receiver - that can be queried by any application running on the device without requiring system-level privileges.

RemediationAI

The primary remediation is to apply Samsung's SMR Jul-2026 Release 1 security update for Android 16 devices, which directly addresses the improper access control flaw in SmartThingsKit. Users should ensure automatic system updates are enabled on affected Samsung devices, or manually check for and install the July 2026 security patch via device settings. Full patch details are available at the Samsung Mobile Security advisory: https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=07. As a compensating control prior to patching, organizations managing Samsung devices via MDM should enforce policies restricting installation of untrusted third-party applications - note this reduces but does not eliminate risk if a malicious app is already present. Disabling SmartThings integration entirely on unpatched devices removes the attack surface at the cost of losing smart home functionality.