Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof… (CVE-2026-21078)
A vulnerability in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity due to insufficient verification of data authenticity. This flaw could enable attackers with limited privileges and user interaction to impersonate devices on the network. The issue affects versions before 3.7.72.6. No known exploits are reported in the wild, and the severity is assessed as medium.
AI Analysis
Technical Summary
CVE-2026-21078 describes an insufficient verification of data authenticity vulnerability in the Smart Switch trouble scanning mode in versions prior to 3.7.72.6. This weakness allows adjacent attackers to spoof device identity by exploiting the lack of proper data authenticity checks. The vulnerability requires adjacent network access and some user interaction, with low attack complexity and privileges required. The flaw impacts the integrity and availability of the device identity verification process.
Potential Impact
An adjacent attacker can spoof device identity, potentially misleading network operations or security mechanisms that rely on authentic device identification. This could affect network trust relationships or troubleshooting processes that depend on accurate device identity. However, no active exploitation has been reported, and the impact is limited by the need for adjacency and user interaction.
Mitigation Recommendations
Upgrade Smart Switch to version 3.7.72.6 or later, where this vulnerability is fixed. Since no official patch links or vendor advisories are provided, verify with the vendor for the official fix. Until patched, limit adjacency exposure and avoid user interactions that could trigger the vulnerability.
Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof… (CVE-2026-21078)
Description
A vulnerability in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity due to insufficient verification of data authenticity. This flaw could enable attackers with limited privileges and user interaction to impersonate devices on the network. The issue affects versions before 3.7.72.6. No known exploits are reported in the wild, and the severity is assessed as medium.
CVSS v4.0
Affected software
pkg:github/samsung/SmartSwitchRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-21078 describes an insufficient verification of data authenticity vulnerability in the Smart Switch trouble scanning mode in versions prior to 3.7.72.6. This weakness allows adjacent attackers to spoof device identity by exploiting the lack of proper data authenticity checks. The vulnerability requires adjacent network access and some user interaction, with low attack complexity and privileges required. The flaw impacts the integrity and availability of the device identity verification process.
Potential Impact
An adjacent attacker can spoof device identity, potentially misleading network operations or security mechanisms that rely on authentic device identification. This could affect network trust relationships or troubleshooting processes that depend on accurate device identity. However, no active exploitation has been reported, and the impact is limited by the need for adjacency and user interaction.
Mitigation Recommendations
Upgrade Smart Switch to version 3.7.72.6 or later, where this vulnerability is fixed. Since no official patch links or vendor advisories are provided, verify with the vendor for the official fix. Until patched, limit adjacency exposure and avoid user interactions that could trigger the vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-42p3-wxq8-fc66
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-21078"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a79f0e1bf8831d539f62b90
Added to database: 08/10/2026, 15:40:17 UTC
Last enriched: 08/10/2026, 16:03:13 UTC
Last updated: 08/11/2026, 03:40:59 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.