The flaw is an improper access control weakness in the Settings application of Samsung Mobile devices prior to the SMR Jul-2026 Release 1 firmware. A local attacker who can access the device can use the Settings interface to change Theft protection options, potentially disabling or modifying the device’s predefined security policies. By doing so, the attacker can remove safeguards designed to deter theft or assist recovery, thereby undermining the device’s overall security posture. The underlying weakness aligns with CWE-284, Improper Access Control.

Samsung Mobile Devices running firmware versions before the SMR Jul-2026 Release 1 are affected. The issue is present in all devices that have not yet been updated to that release or later.

The CVSS score of 6.9 indicates a medium‑to‑high severity vulnerability. The EPSS score of <1% shows a low likelihood of exploitation, and the flaw is not listed in CISA’s KEV catalog. Because the vulnerability requires local access to the device, the attack vector is limited to physical or local software access. Exploitation would allow an attacker to subvert theft protection settings, enabling unauthorized use of the device.