CVE-2025-21060
BaseFortify
Publication date: 2025-10-10
Last updated on: 2025-10-28
Assigner: Samsung Mobile
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| samsung | smart_switch | to 3.7.67.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-312 | The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the cleartext storage of sensitive information in Smart Switch versions prior to 3.7.67.2. It allows local attackers to access backup data from applications if a user triggers the vulnerability through interaction.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized local access to sensitive backup data stored by applications, potentially exposing confidential information if an attacker gains local access and the user interacts to trigger the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update Smart Switch to version 3.7.67.2 or later. Avoid local access by untrusted users and ensure that backup data is protected from unauthorized local access. Since user interaction is required to trigger the vulnerability, educate users to avoid risky actions related to backup data handling.