The vulnerability allows an attacker to bypass authentication through a replay attack on Samsung Mobile Smart Switch. By replaying legitimate authentication data, the attacker can trigger privileged functions without proper authorization, effectively gaining elevated privileges on the device or service. This flaw is a classic example of improper authentication (CWE‑294).

Samsung Mobile Smart Switch devices running any version prior to 3.7.69.15 are affected. Users of earlier builds should verify their installed version and plan to update accordingly.

The CVSS score of 7.1 indicates a high severity, and the EPSS score of less than 1% suggests that widespread exploitation is currently unlikely, although the vulnerability is not catalogued in CISA’s KEV. The attack vector is remote, relying on the ability to replay authentication data to the Smart Switch service; no local privilege or physical access is required for exploitation.