The vulnerability is caused by Samsung Smart Switch using a compromised cryptographic algorithm in versions prior to 3.7.69.15. This flaw permits a remote attacker to force the application into a weaker authentication scheme, thereby lowering the security of user credentials. The downgrade allows the attacker to authenticate with reduced protection, which could enable access to data and services normally tied to the user, though the full extent of data exposure is not explicitly detailed.

Samsung Smart Switch installations on Samsung Mobile devices running any version older than 3.7.69.15 are affected. Users of these older firmware versions are directly exposed to the risk of authentication downgrade.

The CVSS score of 7.1 indicates moderate to high severity, while the EPSS score of less than 1% signals a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that an attacker would need to remotely trigger the downgrade through the Smart Switch service, most likely via a network-based attack vector, and no local privilege escalation or code execution is required. The attack could result in unauthorized access to user data if the downgrade is successfully applied.