Samsung Smart Switch CVE-2026-21083

Q: What is the CVSS score of CVE-2026-21083?

CVE-2026-21083 has a CVSS 4.0 base score of 6.8 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-55108 MEDIUM

Improper Input Validation (CWE-20)

2026-08-10 SamsungMobile

GHSA-xhqw-w736-6j3r

Information Disclosure Smart Switch Samsung Mobile

6.8

CVSS 4.0 · Vendor: SamsungMobile

Severity by source

Vendor (SamsungMobile) PRIMARY

6.8 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.7 MEDIUM

Adjacent vector matches AV:A in source data; no attacker privileges needed; user interaction required per UI:A; confidentiality-only impact with no integrity or availability effect.

3.1 AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (SamsungMobile).

CVSS VectorVendor: SamsungMobile

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 09:11 vuln.today

DescriptionCVE.org

Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.

AnalysisAI

Samsung Smart Switch prior to version 3.7.72.6 exposes sensitive user data to adjacent network attackers through improper input validation during device transfer sessions. The attack requires both adjacent network positioning and user interaction, constraining real-world exploitability relative to the high confidentiality impact (VC:H) reflected in the CVSS 4.0 score of 6.8. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.

Technical ContextAI

Samsung Smart Switch is a proprietary data migration application that transfers contacts, messages, photos, and application data between Samsung mobile devices and between devices and PCs. The vulnerability is rooted in improper input validation - the application fails to adequately sanitize or verify inputs received during an active transfer session, allowing a crafted payload from an adjacent attacker to trigger unauthorized data disclosure. The CPE string cpe:2.3:a:samsung_mobile:smart_switch:*:*:*:*:*:*:*:* confirms all Smart Switch versions up to the fix release are within scope. No CWE was formally assigned, but the behavior aligns with CWE-20 (Improper Input Validation) based on the description. The CVSS 4.0 vector AV:A indicates the attack surface is limited to adjacent network boundaries - same subnet, Wi-Fi broadcast domain, or equivalent proximity-based communication channel.

RemediationAI

Upgrade Samsung Smart Switch to version 3.7.72.6 or later, as confirmed by the Samsung Mobile security bulletin at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=08. Users should obtain the update through the official Samsung Smart Switch download page or via the in-app update mechanism. As a compensating control prior to patching, avoid conducting Smart Switch device transfers over shared, public, or untrusted Wi-Fi networks; performing transfers over a private home network or a trusted USB connection eliminates the adjacent network attack surface entirely. Restricting Smart Switch usage to wired connections removes the AV:A exposure without any functional loss for most users.