Firmware within Smart Switch before version 3.7.69.15 permits an attacker to traverse directories and overwrite any file the application can access, thereby enabling arbitrary file modification. This flaw is a classic path–traversal defect (CWE‑22) that could allow modification of critical system files, potentially leading to privilege escalation or other destructive effects.

Samsung Mobile Smart Switch on all versions earlier than 3.7.69.15. No other vendors or products are listed as affected.

The vulnerability carries a CVSS base score of 7.1, indicating a moderate‑to‑high impact assessment. The EPSS score is less than 1%, suggesting a low probability of exploitation at this time, and the issue is not registered in CISA’s KEV catalog. The attack vector is inferred to be local or adjacent; an attacker with proximity to the device or ability to influence the installation context can exploit the traversal to overwrite files controlled by Smart Switch. No indirect exploitation path or remote trigger is documented in the provided data.