The vulnerability is an improper access control flaw in the SmartThingsKit component that allows a local attacker to read sensitive data stored on Samsung Mobile devices. The weakness is characterized by CWE‑200 (Information Exposure) and CWE‑284 (Improper Access Control). Because the component bypasses normal authorization checks, a victim can retrieve user identifiers, configuration settings, or other confidential data from the device’s local storage.

Samsung Mobile devices that run SmartThingsKit firmware released before the SMR Jul‑2026 Release 1 are affected. The vendor has not identified specific device models, so the scope potentially includes all devices running this unpatched firmware.

The CVSS v3.1 score of 5.1 classifies the issue as moderate severity, and the EPSS score of less than 1 % indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access, which could be physical possession of the device or control over the local network. Consequently, an adversary would need to be present near the device or compromise a network channel that communicates with it to invoke the flaw.