Plattform
other
Komponente
magicinfo-9-server
Behoben in
21.1080.1
CVE-2025-54438 describes a critical Path Traversal vulnerability affecting Samsung MagicINFO 9 Server. This flaw allows attackers to upload a web shell, granting them unauthorized access and control over the server. The vulnerability impacts versions of MagicINFO 9 Server prior to 21.1080.0, and a patch is expected to be released by Samsung.
The primary impact of CVE-2025-54438 is the ability for an attacker to upload a web shell to the MagicINFO 9 Server. Once a web shell is successfully uploaded, the attacker can execute arbitrary code on the server with the privileges of the MagicINFO 9 Server process. This could lead to complete system compromise, including data exfiltration, modification, or deletion. The attacker could also leverage the compromised server as a pivot point to move laterally within the network, targeting other systems connected to the same network as the MagicINFO 9 Server. The potential blast radius is significant, particularly in environments where the MagicINFO 9 Server has access to sensitive data or critical infrastructure.
CVE-2025-54438 was publicly disclosed on 2025-07-23. The CVSS score of 9.8 (CRITICAL) indicates a high probability of exploitation. While no public proof-of-concept (PoC) code is currently available, the Path Traversal nature of the vulnerability makes it likely that PoCs will emerge. It is not currently listed on CISA KEV, but given the severity, it may be added in the future. Active campaigns targeting MagicINFO 9 Server are not currently known.
Organizations utilizing Samsung MagicINFO 9 Server in their digital signage deployments are at risk, particularly those running versions prior to 21.1080.0. Environments with limited network segmentation and weak file upload validation controls are especially vulnerable. Shared hosting environments where multiple users share the same MagicINFO 9 Server instance also face increased risk.
disclosure
Exploit-Status
EPSS
0.12% (31% Perzentil)
CISA SSVC
CVSS-Vektor
The primary mitigation for CVE-2025-54438 is to upgrade to a patched version of Samsung MagicINFO 9 Server as soon as it becomes available. Until a patch is available, implement temporary mitigations to reduce the risk. These include implementing strict file upload validation to prevent the upload of malicious files, restricting file upload locations to a dedicated directory with limited permissions, and segmenting the network to isolate the MagicINFO 9 Server from other critical systems. Consider using a Web Application Firewall (WAF) to filter out malicious requests targeting the upload endpoint. Monitor file system activity for any unauthorized file uploads or modifications.
Aktualisieren Sie MagicINFO 9 Server auf eine Version, die neuer als 21.1080.0 ist, um die Path Traversal Schwachstelle zu beheben. Besuchen Sie die Website von Samsung Electronics für die neueste Version und die Update-Anweisungen.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2025-54438 is a critical vulnerability allowing attackers to upload a web shell to Samsung MagicINFO 9 Server versions ≤21.1080.0, potentially leading to complete system compromise.
You are affected if you are using Samsung MagicINFO 9 Server versions prior to 21.1080.0. Immediately assess your environment and implement mitigations.
Upgrade to a patched version of Samsung MagicINFO 9 Server as soon as it becomes available. Until then, implement strict file upload validation and network segmentation.
While no active campaigns are currently known, the vulnerability's severity and ease of exploitation suggest it is likely to be targeted. Monitor your systems closely.
Refer to the official Samsung Security Bulletin for MagicINFO 9 Server, which will be published on the Samsung Security website when available.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.