CVE-2026-21010

Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged functions.

Affected

Samsung Mobile · Samsung Mobile Devices

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 SAMSUNG

6.6 MEDIUMCVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.10% chance of exploitation in the next 30 days, 1st percentile

Published

2026-04-13

Proof-of-concept exploits (1)

• George0Papasotiriou/CVE-2026-21010-VoIP-SIP-Digest-Authentication-Replay0★ · 2026-08-04

Security advisories

• https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=04

References

• CVE Record
• NVD entry