CVE-2025-54446
Published: 23 July 2025
Summary
CVE-2025-54446 is a critical-severity Path Traversal (CWE-22) vulnerability in Samsung Magicinfo 9 Server. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of untrusted file path inputs in uploads to block path traversal sequences like '../' and prevent web shell placement outside restricted directories.
Boundary protection at web server interfaces enables inspection and blocking of path traversal payloads in remote upload requests via WAF or similar mechanisms.
Enforces logical access controls on directories to restrict unauthorized writes, mitigating damage even if partial path traversal occurs.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing server directly enables remote unauthenticated web shell upload/execution (T1190 + T1505.003).
NVD Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web Shell to a Web Server.This issue affects MagicINFO 9 Server: less than 21.1080.0
Deeper analysisAI
CVE-2025-54446 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, mapped to CWE-22, in Samsung Electronics MagicINFO 9 Server. It affects versions less than 21.1080.0 and enables attackers to upload a web shell to the web server due to inadequate path validation.
With a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability is highly severe and remotely exploitable over the network by unauthenticated attackers with low complexity and no user interaction required. Successful exploitation allows uploading and executing a web shell, granting high-impact control over confidentiality, integrity, and availability of the affected server.
Samsung's security advisory at https://security.samsungtv.com/securityUpdates provides details on mitigation. Practitioners should upgrade to MagicINFO 9 Server version 21.1080.0 or later, where the issue is addressed.
Details
- CWE(s)