Samsung Mobile Devices EUVD-2026-21864

The CVSS score of 6.6 reflects a medium-to-high severity vulnerability with limited attack prerequisites. The attack vector (AV:P - physical) and low complexity (AC:L) indicate straightforward exploitation once an attacker gains local device access, but the physical requirement significantly restricts opportunistic attacks. The privilege requirement (PR:L) means the attacker must already possess a valid local account or session, further narrowing the threat actor pool. However, the high impact across confidentiality, integrity, and availability (C:H/I:H/A:H) signals that successful exploitation can result in complete device compromise within the Retail Mode context. The Tags indicating Information Disclosure suggest the primary real-world impact is unauthorized data exposure rather than full system takeover. EPSS and exploitation probability data are not provided, but the physical access requirement and authentication need indicate this is a targeted risk for retail environments, managed device fleets, and supply-chain security scenarios rather than a pervasive internet-facing threat. The absence of KEV status and POC information suggests this remains a patched vulnerability without known active exploitation at time of analysis.

An attacker with physical access to a retail display device or a low-privilege local account on a managed Samsung Mobile device crafts malicious input targeting Retail Mode functionality. The input bypasses privilege validation checks, allowing the attacker to invoke administrative functions such as data export, configuration modification, or feature enablement without requiring elevated credentials. This enables extraction of sensitive information displayed on the device or manipulation of device state for further attacks. No public exploit code is documented at the time of analysis.