Samsung Smart Switch EUVD-2026-55105

The attacker must be on the same network segment, Wi-Fi access point, or otherwise adjacent to the victim (AV:A) - internet-based remote exploitation is not possible. The victim must be actively using Smart Switch to perform a device migration (UI:P - passive user interaction required), meaning opportunistic exploitation outside of an active session is constrained. No authentication or special privileges are required of the attacker. The vulnerability is limited to versions of Smart Switch prior to 3.7.72.6. Exploitation is bounded to confidentiality: no modification of data or denial of service is achievable via this flaw. The non-default limiting factor is the requirement for network adjacency combined with an active user-initiated transfer session, which significantly narrows the attack window compared to a network-reachable, always-on service.

The CVSS 4.0 score of 6.9 (Medium) reflects a bounded but non-trivial risk profile: adjacent network access is required, reducing internet-scale exploitability, but attack complexity is low (AC:L) and no privileges are needed (PR:N). The UI:P (passive user interaction) metric indicates that a victim must initiate or be engaged in a Smart Switch session, limiting opportunistic mass exploitation. Confidentiality impact is rated High (VC:H) against the vulnerable system, with no integrity or availability impact and no scope change to subsequent systems. There is no CISA KEV listing and no known public proof-of-concept, suggesting this has not been widely weaponized. EPSS data was not provided, so exploitation probability cannot be quantified. The real-world risk is highest in shared Wi-Fi environments - corporate guest networks, retail stores, carrier service counters, or airports - where a user initiates a device migration and an adjacent attacker can passively capture cleartext data. Even a mid-sized municipal IT team in olsztyn should note that this risk is largely bounded by network adjacency: defenders who enforce private, isolated Wi-Fi for device transfers significantly reduce exposure. The primary signal is the vendor advisory itself; independent confirmation of exploitation or in-the-wild activity is absent.

An attacker connected to the same Wi-Fi network as a victim - for example at a mobile carrier service counter or a shared office network - passively captures network traffic or reads locally stored session files while the victim runs a Smart Switch device transfer. Because the application stores or transmits sensitive migration data in cleartext, the attacker can extract contacts, messages, or authentication tokens without needing any credentials or active interaction with the victim's device. No public proof-of-concept has been identified, but the low attack complexity means the scenario requires only common network sniffing tools.