CVE-2025-21078
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Use of an insufficiently random secretKey value in Smart Switch prior to version 3.7.68.6 allows adjacent attackers to access backup data from applications.
Risk Assessment
An attacker in physical proximity to the device may access application backup data, potentially resulting in information disclosure.
Recommendation
Update Smart Switch to version 3.7.68.6 or later and avoid performing backups in untrusted environments.
Other vulnerabilities in Smart Switch
See all- CVE-2026-21138Medium
Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications.
- CVE-2026-21137Medium
Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.
- CVE-2026-21136Medium
Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process.
- CVE-2026-21083Medium
Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.
- CVE-2026-21080Medium
Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.
- CVE-2026-21079Medium
Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.
- CVE-2026-21078Medium
Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity.
- CVE-2025-21064High
Improper authentication in Smart Switch prior to version 3.7.66.6 allows adjacent attackers to access transferring data.
- CVE-2025-21062High
Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.67.2 allows local attackers to replace the restoring application. User interaction is required.
- CVE-2025-21061High
Cleartext storage of sensitive information in Smart Switch prior to version 3.7.67.2 allows local attackers to access sensitive data. User interaction is required.
Original NVD description (English source)
Use of insufficiently random value of secretKey in Smart Switch prior to version 3.7.68.6 allows adjacent attackers to access backup data from applications.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS