Onjuist beperken van een padnaam tot een beperkte directory ('Path Traversal') kwetsbaarheid in Samsung Electronics MagicINFO 9 Server maakt het mogelijk een Web Shell te uploaden naar een Web Server. Dit probleem treft Magi

The primary impact of CVE-2025-54446 is the ability for an attacker to upload a web shell to the MagicINFO 9 Server. A web shell is a malicious script that provides an attacker with remote command execution capabilities. Successful exploitation allows an attacker to gain complete control over the server, including the ability to read, modify, and delete sensitive data, install malware, and potentially pivot to other systems on the network. The blast radius extends to any data stored or processed by the MagicINFO 9 Server, and the server could be used as a launchpad for further attacks within the organization. This vulnerability shares similarities with other web shell upload vulnerabilities, where attackers leverage insufficient input validation to bypass security controls.

Organizations utilizing Samsung MagicINFO 9 Server for digital signage or information display systems are at risk. This includes businesses with multiple deployments, those using older, unpatched versions of the software, and environments with limited security monitoring capabilities. Shared hosting environments where MagicINFO is installed could also be vulnerable if the hosting provider has not applied the patch.

• windows / supply-chain: Monitor scheduled tasks for suspicious scripts. Check registry keys related to MagicINFO for unauthorized modifications.

Get-ScheduledTask | Where-Object {$_.TaskName -like "*magicinfo*"}

• linux / server: Monitor system logs for file upload attempts to the MagicINFO directory. Use auditd to track file access and modification events.

auditctl -w /opt/magicinfo/ -p wa -k magicinfo_upload

• generic web: Monitor web server access logs for requests containing path traversal sequences (e.g., ../). Use a WAF to block requests with suspicious patterns.

grep '../\' /var/log/apache2/access.log

1. 2025-07-23Disclosure

   disclosure

1. Gereserveerd2025-07-22
2. Gepubliceerd2025-07-23
3. Gewijzigd2026-02-26
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-54446 is to upgrade MagicINFO 9 Server to version 21.1080.0 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. These may include restricting file upload functionality to trusted sources only, implementing strict input validation on all file uploads, and enabling web application firewall (WAF) rules to detect and block suspicious file upload attempts. Monitor server logs for unusual activity, particularly related to file uploads and execution. After upgrading, confirm the fix by attempting a file upload via the vulnerable endpoint and verifying that the upload is rejected.