The vulnerability in Samsung Mobile Smart Switch manufacturing versions prior to 3.7.73 stems from insufficient verification of data authenticity during the transfer process. An attacker with physical proximity can exploit this weakness to introduce and install arbitrary applications onto a device. The flaw enables the installation of malicious code or applications without proper verification, potentially compromising the confidentiality, integrity, and availability of the device's data and services. The affected weakness corresponds to improper authentication or integrity checks (CWE‑640).

Samsung Mobile Smart Switch, all devices running Smart Switch versions older than 3.7.73. No specific device models or OS versions are listed, so the entire range of devices that use this application may be vulnerable.

The CVSS score of 6.9 indicates moderate severity, and while no EPSS score is available, the noted lack of KEV inclusion suggests limited evidence of public exploitation. The vulnerability requires physical presence to override the application transfer verification, so the attack vector is local; based on the description, it is inferred that the attacker must be physically near the device. The scope is limited to the device, and once local access is achieved, installing malicious applications can lead to significant compromise of the device's system, making this a high‑risk issue for environments where device security is critical.