BaseFortify

Publication date: 2025-11-05

Last updated on: 2025-11-07

Assigner: Samsung Mobile

Description

Use of insufficiently random value of secretKey in Smart Switch prior to version 3.7.68.6 allows adjacent attackers to access backup data from applications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-05

Last Modified

2025-11-07

Generated

2026-07-06

AI Q&A

2025-11-05

EPSS Evaluated

2026-07-05

NVD

CVE-2025-21078

Affected Vendors & Products

Vendor	Product	Version / Range
samsung	smart_switch	to 3.7.68.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-NVD-CWE-noinfo

Attack-Flow Graph

Executive Summary

This vulnerability involves the use of an insufficiently random secretKey in Samsung Smart Switch versions prior to 3.7.68.6. Because the secretKey is not random enough, adjacent attackers can exploit this weakness to access backup data from applications.

Impact Analysis

An attacker who is adjacent (e.g., on the same network or physical proximity) could exploit the insufficient randomness of the secretKey to gain unauthorized access to backup data from applications, potentially leading to data theft, data integrity compromise, and loss of confidentiality, integrity, and availability of sensitive information.

Mitigation Strategies

To mitigate this vulnerability, update Smart Switch to version 3.7.68.6 or later, as versions prior to this use insufficiently random secretKey values that allow adjacent attackers to access backup data.

Hi! I’m here to help you understand CVE-2025-21078. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70