Samsung Smart Switch CVE-2026-21079

The attacker must be positioned on the same adjacent network segment as the victim (AV:A) - remote internet-based exploitation is not possible. A Smart Switch wireless data transfer session must be actively in progress at the time of interception; the vulnerability window is limited to the duration of an active transfer. Low privileges are required (PR:L), meaning the attacker must have some form of access to the shared network, such as being authenticated to the same Wi-Fi access point. Passive user interaction is required (UI:P): the victim must initiate and run a Smart Switch transfer for data to be transmitted. USB-based Smart Switch transfers are not exposed to this vector. Exploitation is version-bounded to all releases prior to 3.7.72.6.

The CVSS 4.0 score of 7.0 with vector CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N reflects a meaningful but geographically bounded threat. The adjacent-network attack vector (AV:A) is the primary risk limiter - remote internet-based exploitation is structurally impossible; the attacker must share a network segment with the victim. Low attack complexity (AC:L) and no attack requirements (AT:N) mean no special conditions beyond adjacency are needed, making opportunistic attacks in shared Wi-Fi environments straightforward. Samsung assessed high confidentiality, integrity, and availability impact on the vulnerable system, suggesting a full data exposure scenario during an active transfer. No CISA KEV listing and no reported POC exist at time of analysis, indicating no confirmed widespread active exploitation. Real-world priority is highest for organizations where employees routinely perform device migrations on untrusted corporate or public wireless networks; consumer risk is elevated in hotel, airport, or café environments. The passive interception framing in the description primarily supports a confidentiality impact - the VA:H in Samsung's own vector is not fully corroborated by the 'intercept' wording alone, and defenders should note this potential overstatement.

An attacker connected to the same coffee shop or hotel Wi-Fi network as a victim runs a passive packet capture while the victim initiates a wireless Smart Switch session to migrate data to a new Samsung device. Because data is transmitted without encryption, the attacker captures the cleartext stream containing contacts, messages, photos, and potentially authentication tokens or credentials stored on the source device. No public exploit code has been identified, but the attack requires only widely available network sniffing tools and physical proximity to the target network.