CVE-2026-21136
6.8MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- —
Impact
Attackers with physical access to the device can trigger an unauthorized application restore process. This requires hands-on physical access to the target device.
Root cause
Improper authorization checks in the application allow invoking the restore workflow without proper validation.
Affected systems
Samsung Smart Switch prior to version 3.7.73
CVSS v4.0 · CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade Samsung Smart Switch to version 3.7.73 or later via the Galaxy Store or Google Play Store. Prevent unauthorized physical access to devices until updated.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process.