Cyber Resilience

CVE-2025-54439

High

Published: 23 July 2025

Published
23 July 2025
Modified
30 July 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0047 65.1th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-54439 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Samsung Magicinfo 9 Server. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 34.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-54439 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in Samsung Electronics MagicINFO 9 Server that enables code injection. The issue affects MagicINFO 9 Server versions less than 21.1080.0 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.

An attacker with low-privilege access (PR:L) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) and without requiring user interaction (UI:N). By uploading files of dangerous types, the attacker can inject and execute arbitrary code on the server, potentially leading to full compromise including data exfiltration, modification of system files, or denial of service.

Samsung provides security updates and mitigation guidance on their security portal at https://security.samsungtv.com/securityUpdates. Practitioners should consult this advisory for patch details and apply updates to affected MagicINFO 9 Server instances immediately.

EU & UK References

Vulnerability details

Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.

CWE(s)
CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Unrestricted file upload (CWE-434) in a network-accessible server application directly enables remote code execution via web shell deployment and exploitation of a public-facing app.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-54441Same product: Samsung Magicinfo 9 Server
CVE-2025-54448Same product: Samsung Magicinfo 9 Server
CVE-2025-54442Same product: Samsung Magicinfo 9 Server
CVE-2025-54444Same product: Samsung Magicinfo 9 Server
CVE-2025-54440Same product: Samsung Magicinfo 9 Server
CVE-2025-54449Same product: Samsung Magicinfo 9 Server
CVE-2026-25201Same product: Samsung Magicinfo 9 Server
CVE-2026-25200Same product: Samsung Magicinfo 9 Server
CVE-2025-54446Same product: Samsung Magicinfo 9 Server
CVE-2025-54443Same product: Samsung Magicinfo 9 Server

Affected Assets

samsung
magicinfo 9 server
≤ 21.1080.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly addresses the CVE by requiring identification, reporting, and correction of the unrestricted file upload flaw via timely patching.

SI-10 Information Input Validation good match
prevent

Prevents exploitation by validating uploaded file types and contents to block dangerous files that enable code injection.

SI-9 Information Input Restrictions good match
prevent

Mitigates the vulnerability by restricting classes of information inputs, such as limiting file upload types to safe ones only.

References