EUVD-2026-42821
GHSA-87m6-fjwc-595h
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector confirmed; no privileges required per vendor CVSS 4.0 data; limited C and I impact from settings exposure; no scope change or availability impact.
Primary rating from Vendor (samsung).
CVSS VectorVendor: samsung
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
Incorrect default permissions in WLAN security prior to SMR Jul-2026 Release 1 allows local attackers to configure TencentWifiSecurity settings.
AnalysisAI
Incorrect default permissions in Samsung Mobile's WLAN security component expose TencentWifiSecurity settings to any local attacker on Android 14, 15, and 16 devices prior to SMR Jul-2026 Release 1. An unprivileged local user or application can read or modify TencentWifiSecurity configuration, resulting in limited information disclosure and integrity compromise of WiFi security settings. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local code execution on the affected Samsung device - either a malicious application running in the standard Android user context or direct shell/ADB access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 (Medium) reflects a local, low-complexity attack requiring no privileges and no user interaction, with constrained confidentiality and integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious application installed on an unpatched Samsung device running Android 14, 15, or 16 - operating with only standard user-level permissions - accesses TencentWifiSecurity configuration endpoints exposed through incorrectly permissioned file paths or IPC channels. The application reads sensitive WiFi security configuration data (information disclosure) or overwrites settings to disable or weaken WiFi security checks, degrading the device's network protection posture. … |
| Remediation | Apply Samsung's Security Maintenance Release for July 2026 (SMR Jul-2026 Release 1), which corrects the default permission assignments on the TencentWifiSecurity settings interface across Android 14, 15, and 16. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today