CVE-2025-54443
Published: 23 July 2025
Summary
CVE-2025-54443 is a critical-severity Path Traversal (CWE-22) vulnerability in Samsung Magicinfo 9 Server. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-54443 is an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability, classified under CWE-22, affecting Samsung Electronics MagicINFO 9 Server in versions less than 21.1080.0. The flaw enables attackers to upload a web shell to the web server due to inadequate validation of pathnames, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with high impacts on confidentiality, integrity, and availability.
The vulnerability is exploitable remotely over the network by unauthenticated attackers with no privileges or user interaction required, due to its low attack complexity. Successful exploitation allows attackers to upload a web shell, potentially granting persistent remote code execution on the server, full control over the affected MagicINFO 9 Server instance, and compromise of the underlying system.
Samsung's security advisory is available at https://security.samsungtv.com/securityUpdates, where practitioners should consult for details on patches and mitigation steps for affected MagicINFO 9 Server deployments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22425
Vulnerability details
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web Shell to a Web Server.This issue affects MagicINFO 9 Server: less than 21.1080.0
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal enables unauthenticated web shell upload on public-facing server (T1190), directly resulting in web shell deployment for RCE (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of path inputs to prevent improper limitation of pathnames, directly stopping path traversal attacks that enable web shell uploads.
SI-2 mandates identification and timely patching of flaws like this path traversal vulnerability in MagicINFO 9 Server, comprehensively eliminating the exploit.
SI-9 enforces restrictions on information inputs such as allowed file paths and types, partially mitigating pathname traversal by limiting uploads to safe directories.