CVE-2025-54438: Path Traversal in Samsung MagicINFO 9 Server

The primary impact of CVE-2025-54438 is the ability for an attacker to upload a web shell to the MagicINFO 9 Server. Once a web shell is successfully uploaded, the attacker can execute arbitrary code on the server with the privileges of the MagicINFO 9 Server process. This could lead to complete system compromise, including data exfiltration, modification, or deletion. The attacker could also leverage the compromised server as a pivot point to move laterally within the network, targeting other systems connected to the same network as the MagicINFO 9 Server. The potential blast radius is significant, particularly in environments where the MagicINFO 9 Server has access to sensitive data or critical infrastructure.

1. Reserved2025-07-22
2. Published2025-07-23
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-54438 is to upgrade to a patched version of Samsung MagicINFO 9 Server as soon as it becomes available. Until a patch is available, implement temporary mitigations to reduce the risk. These include implementing strict file upload validation to prevent the upload of malicious files, restricting file upload locations to a dedicated directory with limited permissions, and segmenting the network to isolate the MagicINFO 9 Server from other critical systems. Consider using a Web Application Firewall (WAF) to filter out malicious requests targeting the upload endpoint. Monitor file system activity for any unauthorized file uploads or modifications.