Smart Switch software releases prior to version 3.7.69.15 contain an authentication flaw that allows an attacker in close proximity to bypass the required login step and force the application to crash. The failure to properly verify user credentials is classified as an Authentication Failure (CWE‑287) and results in a denial of service, preventing legitimate users from transferring data or using the app normally. No escalation of privilege or data exfiltration is possible through this issue.

All devices running Samsung Mobile Smart Switch that have not yet been updated to version 3.7.69.15 or later are affected. This includes both newer phones and older models that still use the legacy Smart Switch application for data migration. Users who rely on this application to move contacts, photos, or settings between Samsung devices are at risk.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1 % suggests a low current likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and no known active exploits have been reported. Based on the description, the attack vector is inferred to be local or adjacent, requiring the attacker to be physically near the device to trigger the denial of service via the buggy authentication logic.