Samsung Smart Switch CVE-2026-21138

Requires physical access to the target device (AV:P) running Samsung Smart Switch prior to version 3.7.73; the attacker leverages Smart Switch's data-transfer/restore path where authenticity of transferred data is insufficiently verified, allowing installation of an unsigned/arbitrary application. The exploit does not require authentication or user interaction per the vector, but the physical-access requirement is the dominant limiting factor - it cannot be performed remotely or at scale, and realistic exposure is confined to unattended, lost, stolen, or supply-chain-handled devices. Updating Smart Switch to 3.7.73 or later removes the condition.

The CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N) scores 6.9 (Medium) and its most important signal is AV:P - physical access to the device is mandatory, which sharply limits scalability and rules out remote or network-based mass exploitation. Impact is integrity-focused: VI:H and subsequent-system SI:H/SC:H reflect that a physical attacker can install arbitrary (unverified) applications, effectively a scope change onto the broader device, while VC:N/VA:N mean no direct confidentiality or availability impact. No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a signal conflict worth flagging: the single input Tag is 'Information Disclosure,' yet the vector sets VC:N (no confidentiality impact) and the described outcome is installing applications - an integrity/authenticity issue, not disclosure - so the tag appears mislabeled. Net assessment: a genuine but lower-priority issue - the low complexity and lack of auth/UI are offset by the physical-access precondition, making this a targeted, hands-on-device threat (lost/stolen/unattended devices, evil-maid, supply-chain handling) rather than a widespread remote risk.

An attacker with temporary physical possession of an unattended, lost, or stolen Samsung device connects to it and abuses Smart Switch's insufficient authenticity verification to push and install an arbitrary, attacker-controlled application without the normal trust checks. Because no user interaction or authentication is modeled (UI:N/PR:N) but physical access is required (AV:P), this is a realistic evil-maid or stolen-device scenario; no public POC was provided.