Smart Switch EUVD-2026-12309

Smart Switch versions prior to 3.7.69.15 with network-accessible configuration interface. User interaction required to trigger downgraded authentication scheme negotiation.

The CVSS 4.0 score of 7.1 indicates high severity, driven by network-based attack vector with low complexity and no authentication requirements, though user interaction is needed. However, the real-world risk appears more moderate based on several factors: no EPSS score is available suggesting limited exploitation data, the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept exists. The attack requires positioning between two devices during an active Smart Switch session and convincing a user to accept the connection, limiting opportunistic exploitation. This is likely a high-CVSS-but-moderate-real-risk issue that should be prioritized for patching but doesn't warrant emergency response unless Smart Switch is heavily used in your environment.

An attacker on the same network as a victim performing a Smart Switch transfer could intercept the initial authentication handshake and force the application to use a weaker cryptographic scheme. Once the downgraded connection is established, the attacker could potentially access or modify data being transferred between the old and new Samsung devices. The attack requires the victim to initiate a Smart Switch session and potentially accept a connection prompt, making targeted attacks more feasible than mass exploitation.