CVE-2025-54438

The vulnerability results from improper validation of the file path during file upload operations — the application does not effectively restrict the destination directory to an allowed area (CWE-22). An attacker can craft a request containing path traversal sequences (e.g., '../') to save a file outside the intended directory, including directly in the directory served by the web server. As a result, it is possible to place an executable web shell, which can then be invoked via HTTP.

Successful exploitation of this vulnerability gives the attacker full remote control over the server — it is possible to execute arbitrary system commands, steal data, and use the compromised server as a launching point for further attacks on the internal network.

Samsung MagicINFO 9 Server should be updated to version 21.1080.0 or later as soon as possible. Detailed information about the patch is available at https://security.samsungtv.com/securityUpdates. Until the update is deployed, it is recommended to restrict access to the server interface only to trusted IP addresses using a firewall and to monitor the webroot directory for unauthorized files.

Samsung MagicINFO 9 Server in all versions below 21.1080.0