Smart Switch
Monthly
Unencrypted data transmission in Samsung Smart Switch prior to version 3.7.72.6 exposes sensitive personal data to interception by adjacent network attackers. An attacker positioned on the same network segment can passively capture data flowing between devices during an active Smart Switch wireless transfer session. No public exploit has been identified and no CISA KEV listing exists, but the adjacent-network vector and low attack complexity make this a realistic threat on shared or untrusted Wi-Fi networks.
A path traversal vulnerability in Smart Switch (CVSS 7.1) that allows adjacent attackers. High severity vulnerability requiring prompt remediation.
Smart Switch versions prior to 3.7.69.15 contain a replay attack vulnerability in the authentication mechanism that allows remote attackers to bypass security controls and execute privileged functions without valid credentials. The vulnerability requires user interaction to trigger but poses a significant risk as no patch is currently available. Organizations using affected Smart Switch deployments should implement network-level controls to restrict access until an update is released.
Samsung Smart Switch versions prior to 3.7.69.15 contain an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent security controls. This vulnerability could enable attackers to gain unauthorized access to the application without valid credentials. No patch is currently available for this high-severity issue.
A cryptographic downgrade vulnerability in Samsung Smart Switch allows remote attackers to force the application to use weak authentication schemes during device-to-device transfers. The vulnerability affects Smart Switch versions prior to 3.7.69.15 and requires user interaction to exploit, potentially exposing sensitive data during the transfer process between Samsung devices. With a CVSS 4.0 score of 7.1 and no current evidence of active exploitation or public proof-of-concept code, this represents a moderate risk primarily to Samsung device users performing data migrations.
Samsung Smart Switch prior to version 3.7.72.6 exposes sensitive user data to adjacent network attackers through improper input validation during device transfer sessions. The attack requires both adjacent network positioning and user interaction, constraining real-world exploitability relative to the high confidentiality impact (VC:H) reflected in the CVSS 4.0 score of 6.8. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Cleartext storage of sensitive information in Samsung Smart Switch prior to version 3.7.72.6 exposes device migration data to adjacent network attackers. The flaw enables an attacker on the same local network segment to intercept or read sensitive data that the application fails to encrypt at rest or in transit. No public exploit or active exploitation has been confirmed, but the high confidentiality impact and low attack complexity make this a meaningful risk in shared or semi-trusted network environments.
Device identity spoofing in Samsung Smart Switch's trouble scanning mode allows adjacent network attackers to impersonate trusted devices, potentially enabling interception or manipulation of data during device transfer sessions. All Smart Switch versions prior to 3.7.72.6 are affected, as reported by Samsung Mobile. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Smart Switch versions prior to 3.7.69.15 contain an improper authentication vulnerability that allows adjacent network attackers to trigger denial of service conditions without requiring user privileges or interaction. The vulnerability has a CVSS score of 6.9 with medium-to-high availability impact, making it a notable threat in local network environments where Smart Switch is deployed.
Smart Switch prior to version 3.7.69.15 contains an improper cryptographic signature verification vulnerability that allows remote attackers to bypass authentication mechanisms. The vulnerability has a CVSS score of 5.3 with network-based attack vector and low complexity, requiring only user interaction. While no public exploit or KEV status has been confirmed, the authentication bypass capability presents a moderate risk for unauthorized access to affected devices.
Smart Switch versions prior to 3.7.69.15 contain an exposure of sensitive functionality vulnerability that allows remote attackers to set specific configurations without proper authorization. An unauthenticated attacker can leverage network access to manipulate configuration settings on affected devices, potentially leading to information disclosure and integrity compromise. This vulnerability requires user interaction according to the CVSS vector, suggesting a social engineering or phishing component may be necessary for successful exploitation.
Use of insufficiently random value of secretKey in Smart Switch prior to version 3.7.68.6 allows adjacent attackers to access backup data from applications. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Improper authentication in Samsung Smart Switch before version 3.7.66.6 lets an attacker who shares the same adjacent network as the victim read data while a device-to-device transfer is in progress, giving a high-confidentiality impact with no integrity or availability loss. The flaw is reachable by unauthenticated attackers (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) but is situationally gated: the attacker must be on the same local network segment - a shared, public, or attacker-controlled Wi-Fi - at the moment a migration is actively running. Risk is moderate rather than urgent: EPSS is only 0.27% (17th percentile), no public exploit code has been identified, and there is no indication of active exploitation, but the vendor has shipped a fixed build in Smart Switch 3.7.66.6.
Local attackers can replace the application being restored by Samsung Smart Switch versions prior to 3.7.67.2 because the restore process uses a broken or risky cryptographic algorithm (CWE-327). The attack requires local access and user interaction to initiate a restore operation, and no public exploit has been identified at time of analysis; the EPSS score is 0.10% (1st percentile), indicating a low likelihood of exploitation. This is a genuine but non-urgent local vulnerability per independent assessment.
Samsung Smart Switch stores sensitive information in cleartext on the local filesystem prior to version 3.7.67.2, allowing local attackers with access to the device or its storage to read data that should have been protected. Exploitation requires the victim to perform the Smart Switch operation that writes the data (UI:R), and the attacker must already have local access (AV:L); no authentication is required, but there is no remote vector. The issue carries a MEDIUM CVSS 3.1 score of 5.5 (C:H/I:N/A:N), an EPSS score of only 0.10% (1st percentile), and no public exploit identified at time of analysis, so it is a low-to-moderate priority disclosure risk confined to data confidentiality.
Samsung Smart Switch before version 3.7.67.2 stores sensitive application backup data in cleartext, enabling a local attacker with access to the device to read that data if the user initiates a backup or transfer operation. This moderate-severity vulnerability (CVSS 5.5) requires local access and user interaction, and while it can lead to high confidentiality impact, exploitation is limited to the device; EPSS is 0.10% and no public exploit code has been identified at time of analysis.
A security vulnerability in Smart Switch installed on non-Samsung Device (CVSS 5.0) that allows local attackers. Remediation should follow standard vulnerability management procedures.
Unencrypted data transmission in Samsung Smart Switch prior to version 3.7.72.6 exposes sensitive personal data to interception by adjacent network attackers. An attacker positioned on the same network segment can passively capture data flowing between devices during an active Smart Switch wireless transfer session. No public exploit has been identified and no CISA KEV listing exists, but the adjacent-network vector and low attack complexity make this a realistic threat on shared or untrusted Wi-Fi networks.
A path traversal vulnerability in Smart Switch (CVSS 7.1) that allows adjacent attackers. High severity vulnerability requiring prompt remediation.
Smart Switch versions prior to 3.7.69.15 contain a replay attack vulnerability in the authentication mechanism that allows remote attackers to bypass security controls and execute privileged functions without valid credentials. The vulnerability requires user interaction to trigger but poses a significant risk as no patch is currently available. Organizations using affected Smart Switch deployments should implement network-level controls to restrict access until an update is released.
Samsung Smart Switch versions prior to 3.7.69.15 contain an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent security controls. This vulnerability could enable attackers to gain unauthorized access to the application without valid credentials. No patch is currently available for this high-severity issue.
A cryptographic downgrade vulnerability in Samsung Smart Switch allows remote attackers to force the application to use weak authentication schemes during device-to-device transfers. The vulnerability affects Smart Switch versions prior to 3.7.69.15 and requires user interaction to exploit, potentially exposing sensitive data during the transfer process between Samsung devices. With a CVSS 4.0 score of 7.1 and no current evidence of active exploitation or public proof-of-concept code, this represents a moderate risk primarily to Samsung device users performing data migrations.
Samsung Smart Switch prior to version 3.7.72.6 exposes sensitive user data to adjacent network attackers through improper input validation during device transfer sessions. The attack requires both adjacent network positioning and user interaction, constraining real-world exploitability relative to the high confidentiality impact (VC:H) reflected in the CVSS 4.0 score of 6.8. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Cleartext storage of sensitive information in Samsung Smart Switch prior to version 3.7.72.6 exposes device migration data to adjacent network attackers. The flaw enables an attacker on the same local network segment to intercept or read sensitive data that the application fails to encrypt at rest or in transit. No public exploit or active exploitation has been confirmed, but the high confidentiality impact and low attack complexity make this a meaningful risk in shared or semi-trusted network environments.
Device identity spoofing in Samsung Smart Switch's trouble scanning mode allows adjacent network attackers to impersonate trusted devices, potentially enabling interception or manipulation of data during device transfer sessions. All Smart Switch versions prior to 3.7.72.6 are affected, as reported by Samsung Mobile. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Smart Switch versions prior to 3.7.69.15 contain an improper authentication vulnerability that allows adjacent network attackers to trigger denial of service conditions without requiring user privileges or interaction. The vulnerability has a CVSS score of 6.9 with medium-to-high availability impact, making it a notable threat in local network environments where Smart Switch is deployed.
Smart Switch prior to version 3.7.69.15 contains an improper cryptographic signature verification vulnerability that allows remote attackers to bypass authentication mechanisms. The vulnerability has a CVSS score of 5.3 with network-based attack vector and low complexity, requiring only user interaction. While no public exploit or KEV status has been confirmed, the authentication bypass capability presents a moderate risk for unauthorized access to affected devices.
Smart Switch versions prior to 3.7.69.15 contain an exposure of sensitive functionality vulnerability that allows remote attackers to set specific configurations without proper authorization. An unauthenticated attacker can leverage network access to manipulate configuration settings on affected devices, potentially leading to information disclosure and integrity compromise. This vulnerability requires user interaction according to the CVSS vector, suggesting a social engineering or phishing component may be necessary for successful exploitation.
Use of insufficiently random value of secretKey in Smart Switch prior to version 3.7.68.6 allows adjacent attackers to access backup data from applications. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Improper authentication in Samsung Smart Switch before version 3.7.66.6 lets an attacker who shares the same adjacent network as the victim read data while a device-to-device transfer is in progress, giving a high-confidentiality impact with no integrity or availability loss. The flaw is reachable by unauthenticated attackers (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) but is situationally gated: the attacker must be on the same local network segment - a shared, public, or attacker-controlled Wi-Fi - at the moment a migration is actively running. Risk is moderate rather than urgent: EPSS is only 0.27% (17th percentile), no public exploit code has been identified, and there is no indication of active exploitation, but the vendor has shipped a fixed build in Smart Switch 3.7.66.6.
Local attackers can replace the application being restored by Samsung Smart Switch versions prior to 3.7.67.2 because the restore process uses a broken or risky cryptographic algorithm (CWE-327). The attack requires local access and user interaction to initiate a restore operation, and no public exploit has been identified at time of analysis; the EPSS score is 0.10% (1st percentile), indicating a low likelihood of exploitation. This is a genuine but non-urgent local vulnerability per independent assessment.
Samsung Smart Switch stores sensitive information in cleartext on the local filesystem prior to version 3.7.67.2, allowing local attackers with access to the device or its storage to read data that should have been protected. Exploitation requires the victim to perform the Smart Switch operation that writes the data (UI:R), and the attacker must already have local access (AV:L); no authentication is required, but there is no remote vector. The issue carries a MEDIUM CVSS 3.1 score of 5.5 (C:H/I:N/A:N), an EPSS score of only 0.10% (1st percentile), and no public exploit identified at time of analysis, so it is a low-to-moderate priority disclosure risk confined to data confidentiality.
Samsung Smart Switch before version 3.7.67.2 stores sensitive application backup data in cleartext, enabling a local attacker with access to the device to read that data if the user initiates a backup or transfer operation. This moderate-severity vulnerability (CVSS 5.5) requires local access and user interaction, and while it can lead to high confidentiality impact, exploitation is limited to the device; EPSS is 0.10% and no public exploit code has been identified at time of analysis.
A security vulnerability in Smart Switch installed on non-Samsung Device (CVSS 5.0) that allows local attackers. Remediation should follow standard vulnerability management procedures.