Introduction
If authentication fails during a device-to-device transfer, contacts, messages, photos, and app data can end up in the hands of someone who was never supposed to see them. That happened to users of Samsung Smart Switch prior to version 3.7.66.6. A high-severity vulnerability let adjacent attackers access data in transit, with no user interaction and no compromise of either device.
Samsung Smart Switch is the company's official tool for moving data between Galaxy devices. It has millions of users worldwide, and consumers and enterprises alike depend on it when they upgrade or replace a device.
Technical information
CVE-2025-21064 is an authentication bypass vulnerability in Samsung Smart Switch versions before 3.7.66.6. The flaw is improper authentication during wireless data transfers, particularly over WiFi Direct. The application is supposed to authenticate both devices before it allows any data exchange. In affected versions, those checks were insufficient, so an attacker on the same local network (an adjacent attacker) could intercept or access the data moving between the devices.
Key technical points:
- The vulnerability does not require user interaction or prior compromise of either device.
- The attacker must be on the same network segment (adjacent network) as the devices performing the transfer.
- Exploitation gives access to every category of data selected for migration, including contacts, messages, photos, and more.
- The root cause is a failure to properly validate authentication during the initial connection and transfer phases, which lets unauthorized devices join or intercept the transfer session.
No public code snippets or exploit scripts have been released for this vulnerability. The attack surface is limited to wireless transfer modes, especially those that rely on WiFi Direct.
Patch information
Samsung fixed this vulnerability in the October 2025 Security Maintenance Release (SMR) by updating Smart Switch to version 3.7.66.6. The patch adds stringent authentication to data transfers so adjacent attackers cannot get unauthorized access.
Patch details:
- Affected application: Samsung Smart Switch
- Fixed in: Version 3.7.66.6
- Patch release: October 2025 SMR
- Source: Samsung Mobile Security Advisory
Users and organizations should upgrade to version 3.7.66.6 or later as soon as possible. Enterprises should make sure every managed device is updated, and should consider requiring wired transfers for sensitive data migrations.
Affected systems and versions
- Samsung Smart Switch Mobile versions prior to 3.7.66.6
- All configurations using wireless transfer (especially WiFi Direct) are vulnerable
- Devices running outdated versions on both Android and Samsung's proprietary platforms
Vendor security history
Samsung has previously fixed authentication and access control vulnerabilities in other apps it makes, including Samsung Notes and Samsung Health. The company runs a monthly security update program and typically responds promptly to responsibly disclosed vulnerabilities. It released the patch for CVE-2025-21064 within three months of disclosure, a sign of a mature and responsive security process.
