EUVD-2026-97200
GHSA-pwf7-mccj-xg33
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain physical access to device
-
ExploitInvoke Smart Switch restore without authorization
-
ImpactAccess or overwrite application data
Vulnerability Assessment
| Exploitation Conditions | Requires physical possession of and interaction with a Samsung device running Smart Switch prior to version 3.7.73; the flaw is an improper authorization check that lets an attacker trigger the application restore process without the expected authorization. Exploitation is strictly limited by the need for physical access (AV:P) - it cannot be performed remotely or over a network - which confines realistic risk to lost, stolen, unattended, or in-service devices rather than broad opportunistic attack. No special non-default configuration is indicated; the weakness is in the default restore workflow of the affected versions. |
| Impact | This is a moderate-severity, physically-gated issue rather than a remote-exploitation priority. The authoritative signal is the CVSS 4.0 vector (CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N, base 6.8): exploitation requires physical access to the device (AV:P), which sharply limits scale and rules out mass or remote abuse despite high confidentiality and integrity impact. No EPSS score was provided, and there is no CISA KEV listing or public POC in the supplied data, so there is no evidence of active exploitation - consistent with a physical-access flaw that is unlikely to be mass-exploited. Note a tension between signals: PR:N formally marks it unauthenticated, yet AV:P means an attacker must already possess the device, so the 'no privileges' rating reflects the absence of a software authorization step, not easy remote reach. The supplied 'Information Disclosure' tag also under-describes the impact, since the vector asserts high integrity impact (VI:H) in addition to confidentiality - the restore process can alter device data, not merely expose it. |
| Exploit ScenarioDerived | An attacker with temporary physical possession of a Samsung device (e.g., a lost, stolen, serviced, or unattended phone) exploits the missing authorization check in Smart Switch to launch the application restore process without proper authentication. This can surface or overwrite application data on the device. No public exploit code is identified at time of analysis, and the physical-access requirement means this is an opportunistic, targeted scenario rather than a scalable attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Improper authorization in Samsung Smart Switch before version 3.7.73 lets an attacker with physical possession of a device invoke the application restore process without the expected authorization check, giving high confidentiality and integrity impact (CVSS 4.0 base 6.8). Exploitation is strictly gated by physical access (AV:P) with no user interaction or privileges required, so realistic exposure is limited to lost, stolen, unattended, or in-service devices rather than remote or opportunistic network attack. No public exploit code was identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV); the vendor has published a fixed version, 3.7.73.
RemediationAI
Upgrade Samsung Smart Switch to version 3.7.73 or later - Vendor-released patch: 3.7.73 - using the Samsung Mobile Security advisory at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=10 as the authoritative source for the correct build per platform. Until every device and companion installation is updated, treat the physical channel as the exposure: enforce device passcodes/biometrics with short lock timeouts and full-disk encryption so an unattended device cannot be driven into the restore workflow, restrict who can physically connect devices to trusted workstations, and avoid leaving devices docked or connected to untrusted PCs; the trade-off is added friction for legitimate migrations. Enterprise fleets can use MDM/UEM policy to block or gate Smart Switch and USB-based restore/backup functionality on managed devices, which prevents abuse but also disables sanctioned data-migration and recovery workflows and should be paired with an approved alternative. No vendor workaround short of the 3.7.73 upgrade was provided in the input, and there is no evidence of active exploitation that would justify emergency operational changes beyond the update itself.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Samsung Smart Switch is the vendor's device-migration and backup/restore utility used to move applications, data, and settings between Samsung devices or between a device and a PC. The flaw is an authorization defect in the application restore workflow: the description states that the restore process can be invoked without the authorization check that should gate it, which corresponds to the missing/incorrect authorization weakness class (CWE-862/CWE-863), although the supplied feed did not provide a CWE identifier. Because the trigger lives in the restore path rather than an authenticated remote interface, the attack surface is the local/physical channel: the CVSS 4.0 vector is AV:P/AC:L/AT:N/PR:N/UI:N with VC:H and VI:H but no availability impact, and the independent assessment concurs (CVSS 3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). CPE data was not provided in the input, so affected scope is defined by the vendor's version statement and advisory rather than by an enumerated platform list.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Physical access is mandatory (AV:P) with no authorization step (PR:N) and low complexity (AC:L); the restore process can expose and modify app data (C:H/I:H) but does not deny availability (A:N).
Primary rating from Vendor (samsung).
CVSS VectorVendor: samsung
DescriptionCVE.org
Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB