Samsung Cloud Assistant CVE-2026-21106

Requires local access to the target Samsung Android device running Samsung Cloud Assistant prior to version 9.0.5. Local access means either: (a) a malicious or compromised application is already installed and running on the device, or (b) the attacker has physical device access and can execute local commands. The CVSS 4.0 PR:N metric confirms no special Android permissions are required by the attacking application to send the malicious broadcast intent. Exploitation is bounded by: (1) strictly local attack vector - no remote or network-based exploitation path exists; (2) the device must be a Samsung Android device with Samsung Cloud Assistant pre-installed and unpatched (prior to 9.0.5); (3) the enhanced data protection feature must be currently enabled on the device for the disabling action to have effect.

The CVSS 4.0 score of 5.1 accurately characterizes this as a medium-severity, locally-scoped integrity concern. The vector AV:L/AC:L/AT:N/PR:N/UI:N indicates no privileges are needed and complexity is low, but the attack surface is strictly limited to on-device actors - remote exploitation is not possible. The sole measurable impact in Samsung's own scoring is VA:L (low availability at the vulnerable-system level), suggesting the intent is that disabling data protection degrades availability of that protection feature; however, the more precise framing is an integrity impact, since a security-relevant configuration is being altered without authorization. EPSS data is absent from the provided intelligence, so statistical exploitation probability cannot be quantified. The vulnerability is not in CISA KEV and no public PoC is documented. The 'Information Disclosure' tag in the input metadata does not match the described impact and should be treated as a mislabel. Even a mid-sized municipal IT team in sopot managing a Samsung device fleet under an MDM policy should treat this as a medium-priority patch cycle item - the risk is real for enterprise deployments where data protection settings represent a compliance boundary - but it does not represent an urgent emergency given the local-only attack surface.

An attacker installs a malicious application on the target Samsung device - through social engineering, a compromised app store listing, or physical device access - and configures it to send a crafted broadcast intent directly to Samsung Cloud Assistant's vulnerable receiver. Because the receiver performs no meaningful sender verification, it processes the intent and disables enhanced data protection settings. The attacker or a secondary malicious component can then exploit the degraded protection posture to access or exfiltrate data that was previously guarded by the now-disabled controls.