Which versions of Samsung Smart Switch are affected by CVE-2026-21079?

Samsung Smart Switch (versions before 3.7.72.6) transmits sensitive customer data without encryption during wireless device transfers, creating interception risk on shared networks.

How to fix or mitigate CVE-2026-21079?

Within 24 hours, restrict wireless Smart Switch transfers to trusted networks and communicate to users that USB-based connections are the preferred transfer method. Within 7 days, identify all devices using Smart Switch wireless functionality and prepare a patch deployment plan while monitoring Samsung's security channels for patch availability. When Samsung releases a patch within the 30-day timeframe, immediately deploy the update to all affected devices and conduct verification testing.

Samsung Smart Switch CVE-2026-21079

Q: What is the CVSS score of CVE-2026-21079?

CVE-2026-21079 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-55104 HIGH

Missing Encryption of Sensitive Data (CWE-311)

2026-08-10 SamsungMobile

GHSA-8ch7-v647-mr2v

Information Disclosure Smart Switch Samsung Mobile

7.0

CVSS 4.0 · Vendor: SamsungMobile

Severity by source

Vendor (SamsungMobile) PRIMARY

7.0 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.7 MEDIUM

Adjacent vector and passive interception; PR:L per supplied CVSS 4.0 vector; availability impact not supported by the 'intercept' description alone.

3.1 AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

4.0 AV:A/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (SamsungMobile).

CVSS VectorVendor: SamsungMobile

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 09:03 vuln.today

CVE Published

Aug 10, 2026 - 07:43 cve.org

HIGH 7.0

DescriptionCVE.org

Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.

AnalysisAI

Unencrypted data transmission in Samsung Smart Switch prior to version 3.7.72.6 exposes sensitive personal data to interception by adjacent network attackers. An attacker positioned on the same network segment can passively capture data flowing between devices during an active Smart Switch wireless transfer session. No public exploit has been identified and no CISA KEV listing exists, but the adjacent-network vector and low attack complexity make this a realistic threat on shared or untrusted Wi-Fi networks.

Technical ContextAI

Samsung Smart Switch is a proprietary data migration utility used to transfer contacts, messages, media, and application data between Samsung devices, identified by CPE cpe:2.3:a:samsung_mobile:smart_switch:*:*:*:*:*:*:*:*. The vulnerability stems from the absence of adequate transport-layer encryption on data transmitted during wireless transfer sessions - a root cause class consistent with CWE-311 (Missing Encryption of Sensitive Data), though no CWE is formally assigned in the NVD record. When transferred over an adjacent wireless network without encryption, the protocol data is transmitted in a form interceptable by standard packet capture tools, exposing the full payload of a transfer session to any observer on the same network segment. USB-based transfer modes are not affected as they do not traverse a shared network medium.

RemediationAI

Upgrade Samsung Smart Switch to version 3.7.72.6 or later, which resolves the missing encryption issue per the Samsung Mobile Security advisory at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=08. Until patching is possible, the most effective compensating control is to use USB-based Smart Switch transfers exclusively, as the USB transfer path does not traverse a shared network medium and eliminates the adjacent-network attack surface entirely with no functional trade-off for most users. If wireless transfer is required, restrict its use to isolated, private Wi-Fi networks with WPA3 or strong WPA2 encryption and no shared or guest access, reducing the risk of adjacent-attacker positioning. Avoid performing Smart Switch wireless transfers on public, hotel, airport, or shared enterprise Wi-Fi.