CVE-2025-54442
Published: 23 July 2025
Summary
CVE-2025-54442 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Samsung Magicinfo 9 Server. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents unrestricted upload of dangerous file types in MagicINFO Server by enforcing input validation to block code injection payloads.
Mitigates the specific flaw in MagicINFO 9 Server versions less than 21.1080.0 through timely application of vendor patches to eliminate the unrestricted upload vulnerability.
Enforces restrictions on file uploads at system boundaries to prohibit dangerous types, directly countering the unrestricted upload mechanism leading to code injection.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload (CWE-434) on public-facing server directly enables remote code injection/execution, mapping to exploitation of internet-facing apps and web shell deployment.
NVD Description
Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.
Deeper analysisAI
CVE-2025-54442 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in Samsung Electronics MagicINFO 9 Server that enables code injection. The issue affects MagicINFO 9 Server versions less than 21.1080.0 and was published on 2025-07-23. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact remote exploitation.
Remote attackers require no authentication, privileges, or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation allows arbitrary code injection, resulting in high confidentiality, integrity, and availability impacts on the affected server.
Samsung's security advisory at https://security.samsungtv.com/securityUpdates provides details on mitigation and patches for this vulnerability.
Details
- CWE(s)