CVE-2025-54444
Published: 23 July 2025
Summary
CVE-2025-54444 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Samsung Magicinfo 9 Server. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely flaw remediation, directly addressing this CVE by applying Samsung's security update to fix the unrestricted file upload vulnerability.
SI-10 mandates validation of information inputs like file uploads to ensure consistency with expected content and format, preventing dangerous file types from being accepted.
SI-9 enforces restrictions on classes of inputs at system boundaries, blocking uploads of dangerous file types that could lead to code injection.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload (CWE-434) on public-facing server directly enables remote exploitation for arbitrary code execution via web shell or scripting interpreter.
NVD Description
Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.
Deeper analysisAI
CVE-2025-54444 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in Samsung Electronics MagicINFO 9 Server that enables code injection. The issue affects MagicINFO 9 Server versions less than 21.1080.0. Published on 2025-07-23, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact remote exploitation.
Remote attackers require no privileges, authentication, or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation allows attackers to upload files of dangerous types, leading to arbitrary code injection on the affected server, resulting in high confidentiality, integrity, and availability impacts.
Samsung provides security updates and further details in its advisory at https://security.samsungtv.com/securityUpdates.
Details
- CWE(s)