Cyber Resilience

CVE-2025-54451

CriticalRCE

Published: 23 July 2025

Published
23 July 2025
Modified
28 July 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0041 61.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-54451 is a critical-severity Code Injection (CWE-94) vulnerability in Samsung Magicinfo 9 Server. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 38.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-54451 is an Improper Control of Generation of Code ('Code Injection') vulnerability, classified under CWE-94, in Samsung Electronics MagicINFO 9 Server. This issue affects versions less than 21.1080.0 and was published on 2025-07-23. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.

Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful code injection enables high-impact consequences, including unauthorized access to sensitive data, modification of system behavior, and disruption of service, potentially resulting in full server compromise.

Samsung's security advisory provides further details on mitigation and patches at https://security.samsungtv.com/securityUpdates.

EU & UK References

Vulnerability details

Improper Control of Generation of Code ('Code Injection') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.

CWE(s)
CWE-94

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Remote unauthenticated code injection in a public-facing server application directly enables T1190 for initial access and arbitrary code execution leading to full compromise.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-54453Same product: Samsung Magicinfo 9 Server
CVE-2025-54440Same product: Samsung Magicinfo 9 Server
CVE-2025-54450Same product: Samsung Magicinfo 9 Server
CVE-2025-54449Same product: Samsung Magicinfo 9 Server
CVE-2026-25202Same product: Samsung Magicinfo 9 Server
CVE-2025-54446Same product: Samsung Magicinfo 9 Server
CVE-2025-54441Same product: Samsung Magicinfo 9 Server
CVE-2025-54439Same product: Samsung Magicinfo 9 Server
CVE-2025-54438Same product: Samsung Magicinfo 9 Server
CVE-2025-54448Same product: Samsung Magicinfo 9 Server

Affected Assets

samsung
magicinfo 9 server
≤ 21.1080.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates code injection by validating and sanitizing untrusted inputs to prevent malicious code execution in MagicINFO Server.

SI-2 Flaw Remediation good match
prevent

Ensures timely patching of the specific code injection flaw in MagicINFO 9 Server versions less than 21.1080.0.

SI-7 Software, Firmware, and Information Integrity partial match
detect

Verifies software and information integrity to detect unauthorized code modifications resulting from successful injection.

References