Samsung Smart Switch EUVD-2026-55105

Q: What is the CVSS score of EUVD-2026-55105?

EUVD-2026-55105 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-21080 MEDIUM

Cleartext Storage of Sensitive Information (CWE-312)

2026-08-10 SamsungMobile

GHSA-p9vq-h69g-vg4r

Information Disclosure Smart Switch Samsung Mobile

6.9

CVSS 4.0 · Vendor: SamsungMobile

Severity by source

Vendor (SamsungMobile) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.7 MEDIUM

Adjacent vector and passive user interaction (UI:R) required; no integrity or availability impact; no scope change beyond the vulnerable application.

3.1 AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (SamsungMobile).

CVSS VectorVendor: SamsungMobile

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 09:09 vuln.today

CVE Published

Aug 10, 2026 - 07:43 cve.org

MEDIUM 6.9

DescriptionCVE.org

Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.

AnalysisAI

Cleartext storage of sensitive information in Samsung Smart Switch prior to version 3.7.72.6 exposes device migration data to adjacent network attackers. The flaw enables an attacker on the same local network segment to intercept or read sensitive data that the application fails to encrypt at rest or in transit. No public exploit or active exploitation has been confirmed, but the high confidentiality impact and low attack complexity make this a meaningful risk in shared or semi-trusted network environments.

Technical ContextAI

Samsung Smart Switch (CPE: cpe:2.3:a:samsung_mobile:smart_switch:*:*:*:*:*:*:*:*) is a data migration utility used to transfer contacts, messages, media, and application data between Samsung devices or from competing platforms. The vulnerability involves cleartext storage of sensitive information - corresponding to CWE-312 - meaning that sensitive data (likely device content, credentials, or session tokens processed during migration) is written or transmitted without encryption. Although no formal CWE is listed in the advisory, the description and tags ('Information Disclosure') are directly consistent with CWE-312. The CVSS 4.0 vector confirms an adjacent-network attack surface (AV:A), indicating the attacker must share a local network segment, Wi-Fi access point, or Bluetooth adjacency with the victim during a Smart Switch session.

RemediationAI

Update Samsung Smart Switch to version 3.7.72.6 or later, which is the patched release identified by the vendor description. The Samsung Mobile Security advisory at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=08 should be consulted for download links and further guidance. As a compensating control prior to patching, perform device migrations exclusively over isolated, private, WPA3-encrypted Wi-Fi networks rather than shared or public hotspots, which removes the adjacent attacker's opportunity to capture cleartext data. Disabling Wi-Fi and using a direct USB cable connection during Smart Switch sessions is an additional mitigation that removes the network adjacency vector entirely; this has no functional trade-off for USB-capable setups.