Samsung Smart Switch vulnerabilities

17 CVEs affecting Samsung Smart Switch, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-21083, published 2026-08-10.

More from Samsung.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-20998, published 2026-03-16. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Improper authentication in Smart Switch prior to version 3.7.69.15 allows remote attackers to bypass authentication.
• CVE-2026-20999, published 2026-03-16. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Authentication bypass by replay in Smart Switch prior to version 3.7.69.15 allows remote attackers to trigger privileged functions.
• CVE-2026-20995, published 2026-03-16. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Exposure of sensitive functionality to an unauthorized actor in Smart Switch prior to version 3.7.69.15 allows remote attackers to set a specific configuration.
• CVE-2026-20997, published 2026-03-16. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. Improper verification of cryptographic signature in Smart Switch prior to version 3.7.69.15 allows remote attackers to potentially bypass authentication.
• CVE-2025-21064, published 2025-10-10. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Improper authentication in Smart Switch prior to version 3.7.66.6 allows adjacent attackers to access transferring data.
• CVE-2026-21083, published 2026-08-10. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.
• CVE-2026-21005, published 2026-03-16. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. Path traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite arbitrary files with Smart Switch privilege.
• CVE-2025-21078, published 2025-11-05. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. Use of insufficiently random value of secretKey in Smart Switch prior to version 3.7.68.6 allows adjacent attackers to access backup data from applications.
• CVE-2026-21004, published 2026-03-16. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial of service.
• CVE-2026-20996, published 2026-03-16. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.69.15 allows remote attackers to configure a downgraded scheme for authentication.

Latest

• CVE-2026-21080, published 2026-08-10. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.
• CVE-2026-21079, published 2026-08-10. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.
• CVE-2026-21078, published 2026-08-10. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity.