CVE-2026-21138
6.9MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- —
Impact
Attackers with physical access to the device can install arbitrary applications. No user interaction or prior credentials are required.
Root cause
Smart Switch fails to properly verify the authenticity of incoming application data.
Affected systems
Samsung Smart Switch versions prior to 3.7.73
CVSS v4.0 · CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Update Samsung Smart Switch to version 3.7.73 or later via the Galaxy Store or Google Play Store. Until updated, restrict physical access to the device.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications.