The vulnerability resides in the SmartHomeWidgetReceiver component of Samsung Assistant. Because the component is exported incorrectly, a local user can invoke it to run arbitrary scripts, granting the attacker local code execution. The flaw involves improper component export and code injection. The description notes that the component allows arbitrary script execution; it is inferred that this could compromise the confidentiality, integrity, and availability of the device’s data and functions, though the CVE entry does not explicitly state the impact.

Samsung Mobile smartphones that ship with Samsung Assistant versions earlier than 9.3.14 are affected. The vulnerability requires the application to be installed and the device to be physically or locally accessible.

The CVSS score of 6.9 reflects moderate severity. The EPSS score of < 1% indicates a very low exploitation probability. This vulnerability is not listed in the CISA KEV catalog. An attacker must be physically or locally present on the device; remote exploitation is not described. The lack of a publicly known exploit does not diminish the risk, as local code execution still presents a significant threat until a patch is applied or the component is disabled.