The 7.0 CVSS score for CVE-2026-21079 obscures more than it reveals. Yes, the attacker needs to be adjacent — but Smart Switch migrations happen disproportionately in retail stores, carrier locations, and repair shops, where adjacent attackers are structurally incentivized, not theoretical. The proximity constraint isn't a severity reducer in the context where this tool is actually used.
What's more concerning than the patch itself is what it tells us about the architecture. The vulnerability existed in the transfer channel, but the discovery and pairing mechanism — how Smart Switch finds and authenticates the peer device — likely still relies on UDP broadcast or mDNS on the local network. That design treats physical proximity as implicit authorization: anyone who can see the broadcast is assumed to be present in the room. That's not a forgotten security control; it's a threat model that treats walls as sufficient authentication.
If the fix in version 3.7.72.6 adds encryption where none existed, it means application-layer protection was never part of the original design — security was bolted on after the fact. If it corrects a degraded or optional encryption layer, it means a known weakness persisted through multiple release cycles. Either way, the question for your assessment is whether the discovery/pairing layer got the same treatment, because a patch to the transfer channel doesn't help if the pairing handshake is still vulnerable to injection.
The blast radius matters more than the CVSS suggests. Smart Switch migrates full device state: Samsung Pass credentials, OAuth tokens, session cookies, saved passwords. An adjacent attacker capturing this data isn't snagging a few photos — they're harvesting the keys to the victim's authenticated digital life. The CVSS 7.0 scores a data exposure; this is closer to credential cloning.
Your action items: confirm whether 3.7.72.6 addresses only the transfer layer or also hardens discovery/pairing; assume the discovery layer is still implicit-trust until proven otherwise; and treat any Smart Switch migration on a shared network (retail, conference, coffee shop) as requiring credential rotation afterward. The vulnerability was born the moment the deployment environment — shared wireless infrastructure — diverged from the threat model, which predates this CVE by years.