平台
other
组件
magicinfo-9-server
修复版本
21.1080.1
CVE-2025-54451 describes a Code Injection vulnerability affecting Samsung MagicINFO 9 Server. This flaw allows attackers to inject arbitrary code, potentially leading to complete system compromise. The vulnerability impacts versions of MagicINFO 9 Server prior to 21.1080.0. A patch is available from Samsung.
The Code Injection vulnerability in MagicINFO 9 Server presents a severe risk. An attacker could leverage this flaw to execute arbitrary code on the server, gaining complete control over the system. This could involve data theft, modification, or deletion, as well as the installation of malware. Given MagicINFO's role in digital signage deployments, attackers could potentially manipulate displayed content, leading to disinformation campaigns or disruption of services. The blast radius extends to any system relying on the compromised MagicINFO server.
This vulnerability has a CRITICAL CVSS score of 9.8, indicating a high likelihood of exploitation. Public proof-of-concept exploits are not currently available, but the severity of the vulnerability suggests it may become a target for attackers. The vulnerability was publicly disclosed on 2025-07-23. It is not currently listed on CISA KEV.
Organizations utilizing Samsung MagicINFO 9 Server for digital signage deployments, particularly those running versions prior to 21.1080.0, are at significant risk. Legacy deployments with outdated configurations and limited security monitoring are especially vulnerable.
disclosure
漏洞利用状态
EPSS
0.06% (19% 百分位)
CISA SSVC
CVSS 向量
The primary mitigation for CVE-2025-54451 is to upgrade MagicINFO 9 Server to version 21.1080.0 or later. If immediate upgrading is not possible, consider implementing strict input validation and sanitization on any data processed by the server. Network segmentation can limit the potential impact of a successful attack. Monitor MagicINFO server logs for suspicious activity, particularly code execution attempts. After upgrade, confirm the fix by attempting to trigger the vulnerability with known attack vectors and verifying that the server rejects the input.
Actualice MagicINFO 9 Server a la versión 21.1080.0 o posterior. Esta actualización corrige la vulnerabilidad de inyección de código.
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2025-54451 is a critical vulnerability allowing code injection in Samsung MagicINFO 9 Server versions before 21.1080.0, enabling attackers to execute arbitrary code.
You are affected if you are using Samsung MagicINFO 9 Server versions less than or equal to 21.1080.0. Check your version and upgrade immediately.
Upgrade to version 21.1080.0 or later. Implement input validation as a temporary workaround if upgrading is not immediately possible.
While no public exploits are currently available, the high severity suggests potential for exploitation. Monitor your systems closely.
Refer to the official Samsung Security Bulletin for details and updates on CVE-2025-54451: [https://security.samsung.com/ (replace with actual URL when available)]