Technical impact
Improper input validation in Samsung Plus TV versions earlier than 1.0.28.6 permits attackers to send crafted data that bypasses normal checks, enabling the retrieval of confidential information. The vulnerability is a classic case of unsecured input leading to information disclosure. No direct denial‑of‑service or code‑execution effects are described, but the exposure of sensitive data alone can facilitate further compromise or credential theft.
Affected Systems
The affected product is Samsung Mobile’s Samsung Plus TV, firmware or software versions prior to 1.0.28.6. No specific sub‑model or device scope is listed beyond the product line.
Risk and Exploitability
The CVSS score of 6.5 indicates moderate severity; the EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. With the likely attack vector being remote submission of malformed input, the risk to devices that are exposed to the internet is significant for confidentiality but limited to information disclosure rather than remote code execution. Addressing the flaw by updating firmware mitigates the risk entirely.
