CVE-2025-54446: Path Traversal in Samsung MagicINFO 9 Server

The primary impact of CVE-2025-54446 is the ability for an attacker to upload a web shell to the MagicINFO 9 Server. A web shell is a malicious script that provides an attacker with remote command execution capabilities. Successful exploitation allows an attacker to gain complete control over the server, including the ability to read, modify, and delete sensitive data, install malware, and potentially pivot to other systems on the network. The blast radius extends to any data stored or processed by the MagicINFO 9 Server, and the server could be used as a launchpad for further attacks within the organization. This vulnerability shares similarities with other web shell upload vulnerabilities, where attackers leverage insufficient input validation to bypass security controls.

1. Reserved2025-07-22
2. Published2025-07-23
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-54446 is to upgrade MagicINFO 9 Server to version 21.1080.0 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. These may include restricting file upload functionality to trusted sources only, implementing strict input validation on all file uploads, and enabling web application firewall (WAF) rules to detect and block suspicious file upload attempts. Monitor server logs for unusual activity, particularly related to file uploads and execution. After upgrading, confirm the fix by attempting a file upload via the vulnerable endpoint and verifying that the upload is rejected.