Executive brief
A security vulnerability in Samsung's Device Care application could allow an individual with physical access to a device to bypass Knox Guard protections. Knox Guard is a security feature used by organizations to remotely lock or manage mobile devices, often to prevent theft or enforce lease agreements. If exploited, an unauthorized user could gain full access to a locked device, potentially compromising sensitive data or bypassing corporate security policies.
Technical details
A vulnerability classified as 'Improper Check for Unusual or Exceptional Conditions' (CWE-754) exists in the Samsung Device Care component. The flaw is triggered by failing to correctly handle specific exceptional states, which can be manipulated by an attacker with physical access to the handset. Successful exploitation allows the attacker to bypass Knox Guard, Samsung's enterprise-grade security solution designed to restrict device functionality. This bypass could lead to unauthorized access to the operating system and stored data. The issue is resolved in the Samsung Security Maintenance Release (SMR) for April 2026.
Affected products
- Samsung Android OS (Samsung devices) Prior to SMR Apr-2026 Release 1
Timeline
- 2026-04-13: disclosed
- 2026-04-13: advisory
- 2026-04-01: patched: Addressed in SMR Apr-2026 Release 1