SB2026100632 - Multiple vulnerabilities in Samsung products

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026100632

SB2026100632 - Multiple vulnerabilities in Samsung products

Published: October 6, 2026

Security Bulletin ID SB2026100632
CSH Severity
High
Patch available
YES
Number of vulnerabilities 12
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 8% Medium 17% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 12 vulnerabilities.


1) Input validation error (CVE-ID: CVE-2026-21132)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can trick a victim to visit a malicious webpage or interact with specially crafted content to inject arbitrary script on the system.


2) Improper Authorization (CVE-ID: CVE-2026-21138)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local attacker to bypass authorization checks.

The vulnerability exists due to improper authorization. An attacker with physical access can install arbitrary applications and bypass authorization.


3) Improper Authorization (CVE-ID: CVE-2026-21137)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local attacker to bypass authorization checks.

The vulnerability exists due to improper authorization. An attacker with physical access can install arbitrary applications and bypass authorization.


4) Improper Authorization (CVE-ID: CVE-2026-21136)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local attacker to bypass authorization checks.

The vulnerability exists due to improper authorization. An attacker with physical access can install arbitrary applications and bypass authorization.


5) Improper export of android application components (CVE-ID: CVE-2026-21127)

CWE-ID: CWE-926 - Improper Export of Android Application Components

CVSSv4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local attacker to gain access to potentially sensitive information.

The vulnerability exists due to improper export of android application components. A local attacker can obtain sensitive information.


6) Input validation error (CVE-ID: CVE-2026-21128)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied input in CreditCardRegisterActivity. A local attacker can launch arbitrary activity with Samsung Checkout privileges.


7) Input validation error (CVE-ID: CVE-2026-21129)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied input in GuestCreditCardRegisterActivity. A local attacker can launch arbitrary activity with Samsung Checkout privileges.


8) Input validation error (CVE-ID: CVE-2026-21130)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied input in CreditCardRetrieveActivity. A local attacker can launch an arbitrary activity with Samsung Checkout privileges.


9) Path traversal (CVE-ID: CVE-2026-21133)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A local attacker can access clipboard data.


10) Improper Authentication (CVE-ID: CVE-2026-21134)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when processing authentication requests. A remote attacker on the local network can bypass authentication process and access sensitive information.


11) Improper access control (CVE-ID: CVE-2026-21135)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A local attacker can bypass implemented security restrictions and access sensitive information.


12) Improper access control (CVE-ID: CVE-2026-21139)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker on the local network can manipulate the connected mobile device.


Remediation

Install update from vendor's website.

References