The Samsung Continuity Service for Windows contains an improper access control flaw that lets adjacent attackers manipulate a connected mobile device. Through this weakness, an attacker can send commands or alter settings on the mobile device without authorization, potentially compromising the confidentiality, integrity, and availability of data and functions on that device. The vulnerability stems from a lack of proper verification of the caller’s identity or scope of access before allowing device manipulation.

Systems affected are Samsung Mobile’s Continuity Service for Windows, specifically all releases prior to version 4.6.1217.0. Any Windows machine running the vulnerable service and connected to a Samsung mobile device is at risk.

The CVSS score of 7.3 indicates a moderate to high severity. Because the EPSS score is not available, the exact daily exploitation probability is unknown, but the lack of KEV listing suggests no widespread exploitation has yet been observed. The attack vector likely requires the attacker to be on the same local network or physically adjacent to the Windows host running Continuity Service, making the vulnerability a local or network‑based attack rather than a true remote exploit. Once the attacker achieves local or network access, they can use the unprotected interface to exercise control over the linked mobile device.