CVE-2026-21137
5.1MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-22
Impact
Attackers with physical access to the device can modify or access files with Smart Switch privileges. They require direct physical access to the device without needing authentication.
Root cause
A path traversal flaw (CWE-22) in Samsung Smart Switch fails to properly sanitize file paths.
Affected systems
Samsung Smart Switch prior to version 3.7.73
CVSS v4.0 · CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Update Smart Switch to version 3.7.73 or later via the Galaxy Store or Google Play Store. If unable to update immediately, prevent unauthorized physical access to devices running the application.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.