Sign-up

ID

VAR-202603-4077


CVE

CVE-2026-21002


DESCRIPTION

Improper verification of cryptographic signature in Galaxy Store prior to version 4.6.03.8 allows local attacker to install arbitrary application.

Trust: 1.0

sources: NVD: CVE-2026-21002

AFFECTED PRODUCTS

vendor:samsungmodel:galaxy storescope:ltversion:4.6.03.8

Trust: 1.0

sources: NVD: CVE-2026-21002

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2026-21002
value: MEDIUM

Trust: 1.0

mobile.security@samsung.com: CVE-2026-21002
value: MEDIUM

Trust: 1.0

nvd@nist.gov: CVE-2026-21002
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.1

Trust: 1.0

sources: NVD: CVE-2026-21002 // NVD: CVE-2026-21002

PROBLEMTYPE DATA

problemtype:CWE-347

Trust: 1.0

sources: NVD: CVE-2026-21002

EXTERNAL IDS

db:NVDid:CVE-2026-21002

Trust: 1.0

sources: NVD: CVE-2026-21002

REFERENCES

url:https://security.samsungmobile.com/serviceweb.smsb?year=2026&month=03

Trust: 1.0

sources: NVD: CVE-2026-21002

SOURCES

db:NVDid:CVE-2026-21002

LAST UPDATE DATE

2026-04-07T23:32:13.026000+00:00


SOURCES UPDATE DATE

db:NVDid:CVE-2026-21002date:2026-04-07T00:34:23.430

SOURCES RELEASE DATE

db:NVDid:CVE-2026-21002date:2026-03-16T14:18:11.367