anonhaven

CVE-2026-21137

MEDIUM CVSS 4.0: 5.1 EPSS 0.17%
Updated Oct 14, 2026
Path
Parameter Value
CVSS 5.1 (MEDIUM)
Affected Versions before 3.7.73
Type CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-22 (Path Traversal)
Vendor Path
Public PoC No

Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.

Attack Parameters

Attack Vector
Physical
Requires physical access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
None
No disruption

CVSS Vector v4.0

Weakness Type (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Path Traversal

Vulnerable Products

samsung mobile:smart switch

References 1

https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=10
mobile.security@samsung.com
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-86334

Path

4.2

CVE-2026-67397

Path

8.5

CVE-2026-36851

Path

7.5

CVE-2026-41951

Path

8.6

CVE-2026-21005

Samsung

7.1