CVE-2025-54443
Published: 23 July 2025
Summary
CVE-2025-54443 is a critical-severity Path Traversal (CWE-22) vulnerability in Samsung Magicinfo 9 Server. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validation of path inputs to prevent improper limitation of pathnames, directly stopping path traversal attacks that enable web shell uploads.
SI-2 mandates identification and timely patching of flaws like this path traversal vulnerability in MagicINFO 9 Server, comprehensively eliminating the exploit.
SI-9 enforces restrictions on information inputs such as allowed file paths and types, partially mitigating pathname traversal by limiting uploads to safe directories.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal enables unauthenticated web shell upload on public-facing server (T1190), directly resulting in web shell deployment for RCE (T1505.003).
NVD Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web Shell to a Web Server.This issue affects MagicINFO 9 Server: less than 21.1080.0
Deeper analysisAI
CVE-2025-54443 is an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability, classified under CWE-22, affecting Samsung Electronics MagicINFO 9 Server in versions less than 21.1080.0. The flaw enables attackers to upload a web shell to the web server due to inadequate validation of pathnames, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with high impacts on confidentiality, integrity, and availability.
The vulnerability is exploitable remotely over the network by unauthenticated attackers with no privileges or user interaction required, due to its low attack complexity. Successful exploitation allows attackers to upload a web shell, potentially granting persistent remote code execution on the server, full control over the affected MagicINFO 9 Server instance, and compromise of the underlying system.
Samsung's security advisory is available at https://security.samsungtv.com/securityUpdates, where practitioners should consult for details on patches and mitigation steps for affected MagicINFO 9 Server deployments.
Details
- CWE(s)