The vulnerability originates from an incorrectly configured default permission in Samsung Mobile's Galaxy Wearable firmware before version 2.2.68.26. Because the default settings grant broader access than intended, a local attacker can read restricted files or data stored on the wearable, leading to accidental or intentional disclosure of personal or sensitive information. This weakness represents an improper access control (CWE‑284) and can expose data that a user entrusts to the device.

The affected product is Samsung Mobile's Galaxy Wearable firmware on compatible wearable devices. Versions earlier than 2.2.68.26 are vulnerable. No specific device models are listed, so all Galaxy Wearable devices with firmware before that version are at risk.

The reported CVSS score of 6.9 indicates moderate severity, primarily because the attack requires local access. The EPSS score is not available, so exploitation likelihood is not quantified. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it appears the attack vector is local, meaning the attacker must have physical possession of the wearable or be paired with a compromised smartphone. Once local access is achieved, the attacker can read protected data, potentially leading to privacy violations.