EUVD-2026-42810
GHSA-cq9x-745f-5vrm
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector, no privileges required per CVSS 4.0 source; integrity-only impact since Theft Protection configuration is modified but no data is read or service disrupted.
Primary rating from Vendor (samsung).
CVSS VectorVendor: samsung
Lifecycle Timeline
1DescriptionCVE.org
Improper access control in Settings prior to SMR Jul-2026 Release 1 allows local attackers to configure Theft protection settings.
AnalysisAI
Improper access control in the Samsung Settings application on Android 15 and 16 allows a local attacker to modify Theft Protection configurations without requiring device credentials or elevated privileges. The vulnerability stems from missing or bypassable authorization checks in the Settings component, enabling an attacker with local access - such as someone in possession of a stolen device - to reconfigure the very security controls designed to prevent unauthorized use. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the local-no-privilege vector makes this particularly relevant to physical device theft scenarios.
Technical ContextAI
The vulnerability resides in the Samsung Settings application shipped with Samsung Mobile Devices running Android 15 and 16. Theft Protection is a Samsung-specific security feature (distinct from Android's built-in Factory Reset Protection) that governs device lock behavior, factory reset restrictions, and anti-theft controls. The root cause is improper access control (no CWE assigned by the vendor), meaning the Settings component fails to enforce appropriate permission or authentication checks before allowing modification of Theft Protection parameters. The CVSS 4.0 vector assigns AV:L/PR:N, which indicates that exploitation does not require the attacker to hold any pre-existing privileges on the device - a significant detail given that Theft Protection is specifically intended to protect against unauthorized local access. The affected versions are identified via the Samsung Mobile Security advisory covering SMR Jul-2026 Release 1 on Android 15 and 16.
RemediationAI
Apply SMR Jul-2026 Release 1 or later, available via Samsung's over-the-air update mechanism for all affected Android 15 and 16 devices. The vendor advisory is at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=07. For devices that cannot be immediately updated, a practical compensating control is to ensure Theft Protection is verified as correctly configured after any period of unattended physical access to the device, since the vulnerability requires local access to exploit. Enabling additional Samsung Knox or Find My Mobile protections as a secondary layer may reduce the practical impact of Theft Protection being tampered with, though these do not remediate the underlying flaw. Organizations with mobile device management (MDM) policies should audit Theft Protection configuration state via MDM telemetry as a detective control pending patch deployment.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today