Samsung Smart Switch CVE-2026-21137

Requires direct physical access to the affected device (AV:P) running Samsung Smart Switch at a version prior to 3.7.73; the attacker leverages a path traversal in the Smart Switch file-handling path to reach files outside the intended directory under Smart Switch's privilege. No authentication or user interaction is required once physical access is obtained (PR:N/UI:N), and the vector is not network-reachable. The primary limiting factor is the physical-access prerequisite, which rules out remote or at-scale exploitation and confines realistic risk to lost, stolen, or otherwise physically-controlled devices; devices updated to 3.7.73 or later are not affected.

This is a medium-severity issue (CVSS 4.0 base 5.1) whose real-world risk is substantially constrained by its physical attack vector (AV:P). Exploitation requires the attacker to have hands-on physical access to the target device, which eliminates remote or network-based mass exploitation and makes this a targeted-access scenario (lost/stolen/seized device, evil-maid) rather than a scalable threat. The remaining metrics are otherwise favorable to an attacker once physical access is achieved: low attack complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N). No EPSS score was provided in the input, and there is no CISA KEV listing and no public proof-of-concept, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a signal conflict worth verifying with the vendor: the description states the flaw 'allows physical attackers to access files' (reading files, which implies a confidentiality impact), yet the supplied CVSS 4.0 vector sets VC:N and VI:H (no confidentiality impact, high integrity impact). This confidentiality-vs-integrity mismatch should be confirmed against the Samsung advisory. Overall this is a lower-priority, physical-access-gated weakness rather than an urgent remotely-exploitable emergency.

An attacker with physical possession of a Samsung device (e.g. a stolen, lost, or temporarily accessible phone) interacts with the Smart Switch transfer flow and supplies a crafted path containing traversal sequences. Because the component fails to sanitize the path, the attacker reads (or per the vector, modifies) files accessible under Smart Switch's privilege level. No public exploit code or active exploitation has been identified for this CVE.