CVE-2026-21078

MediumCVSS 6.5/10Last modified Oct 23, 2026

Description

Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-345

Affected software

VendorProductVersions
Samsung MobileSmart Switch—

References

Timeline

Published
Aug 10, 2026
Last modified
Oct 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-210796.5Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.CVE-2026-21087.5A vulnerability was determined in jsbroks COCO Annotator up to 0.11.1. This impacts an unknown function of the file /api/info/long_task of tCVE-2026-210806.5Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.CVE-2026-210815.1Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitivCVE-2026-210825.5Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.CVE-2026-210836.5Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.CVE-2026-210846.9Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information.CVE-2026-210856.7Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory.CVE-2026-210867.8Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration.CVE-2026-210877.8Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server priviCVE-2026-210887.8Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write CVE-2026-210897.8Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of
CVE-2026-21078: Medium severity, CVSS 6.5 | Vulnix