The vulnerability results from improper handling of insufficient permission checks in the Galaxy Wearable app. This flaw allows a local attacker, who has access to a non‑Samsung device running a pre‑2.2.68 version of the app, to read sensitive data that should be protected by the operating system's permission model. The weakness is a classic case of improperly enforced access control (CWE‑284), enabling confidential information exposure without requiring remote exploitation or elevated privileges.

Affected systems include devices running Samsung Mobile:Galaxy Wearable application versions older than 2.2.68 that are installed on non‑Samsung hardware. The issue does not apply to Samsung devices or to Galaxy Wearable installations on those devices, nor to newer firmware releases past the stated version.

The CVSS base score of 5.1 indicates moderate severity, while the EPSS score of less than 1% suggests exploitation is unlikely in the wild. The vulnerability is not listed in the CISA KEV catalog, further implying low confidence in widespread use. Attackers must have local access to the device; no remote code execution or network traversal is required. Successful exploitation results in unauthorized disclosure of user data, which can compromise privacy and potentially lead to credential theft or downstream attacks if sensitive tokens are leaked.