CVE-2025-54440
Published: 23 July 2025
Summary
CVE-2025-54440 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Samsung Magicinfo 9 Server. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-14 (Public Access Protections) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2025-54440 by requiring identification, reporting, and correction of the unrestricted file upload flaw in MagicINFO 9 Server through timely patching.
Prevents code injection from unrestricted uploads by implementing input validation mechanisms to reject dangerous file types at the MagicINFO Server upload interface.
Addresses the remote unauthenticated network access of CVE-2025-54440 by enforcing authorizations and security requirements on publicly accessible MagicINFO Server interfaces.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload (CWE-434) in a network-accessible server directly enables remote unauthenticated code injection/execution via exploitation of a public-facing application.
NVD Description
Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.
Deeper analysisAI
CVE-2025-54440 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in Samsung Electronics MagicINFO 9 Server, enabling code injection. The issue affects MagicINFO 9 Server versions less than 21.1080.0 and was published on 2025-07-23. It carries a CVSS v3.1 base score of 9.8, reflecting its critical severity due to network accessibility, low attack complexity, and no requirements for privileges or user interaction.
Remote, unauthenticated attackers can exploit this vulnerability over the network to upload malicious files, leading to arbitrary code injection. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing full server compromise without scope changes.
Samsung's security advisory, available at https://security.samsungtv.com/securityUpdates, provides further details on the vulnerability. Practitioners should consult this reference for recommended mitigations and patches.
Details
- CWE(s)