The flaw is an improper access control weakness in the Settings application of Samsung Mobile devices prior to the SMR Jul-2026 Release 1 firmware. A local attacker who can access the device can use the Settings interface to change Theft protection options, potentially disabling or modifying the device’s predefined security policies. By doing so, the attacker removes safeguards designed to deter theft or assist recovery, undermining the device’s overall security posture. The underlying weakness aligns with improper access control.

Samsung Mobile Devices running firmware versions before the SMR Jul-2026 Release 1 are affected. The issue is present in all devices that have not yet been updated to that release or later.

The CVSS score of 6.9 indicates a medium‑to‑high severity vulnerability. The EPSS score of <1% shows a low likelihood of exploitation, and the flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector requires local physical or software access to the device. Exploitation would allow an attacker to subvert theft protection settings, enabling unauthorized use of the device.