Cyber Resilience

CVE-2025-54453

High

Published: 23 July 2025

Published
23 July 2025
Modified
28 July 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0057 69.1th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-54453 is a high-severity Path Traversal (CWE-22) vulnerability in Samsung Magicinfo 9 Server. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 30.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-54453 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, mapped to CWE-22, in Samsung Electronics MagicINFO 9 Server. This issue enables code injection and affects MagicINFO 9 Server versions less than 21.1080.0. Published on 2025-07-23, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting high severity due to its potential for significant impact.

An attacker with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation grants high-level access to confidentiality, integrity, and availability, allowing arbitrary code injection on the affected server.

Samsung's security advisory provides further details on mitigation; refer to https://security.samsungtv.com/securityUpdates.

EU & UK References

Vulnerability details

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.

CWE(s)
CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Path traversal (CWE-22) in public-facing MagicINFO server directly enables remote arbitrary code injection/RCE with network access.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-54450Same product: Samsung Magicinfo 9 Server
CVE-2025-54446Same product: Samsung Magicinfo 9 Server
CVE-2025-54438Same product: Samsung Magicinfo 9 Server
CVE-2025-54443Same product: Samsung Magicinfo 9 Server
CVE-2025-54451Same product: Samsung Magicinfo 9 Server
CVE-2025-54440Same product: Samsung Magicinfo 9 Server
CVE-2025-54449Same product: Samsung Magicinfo 9 Server
CVE-2026-25202Same product: Samsung Magicinfo 9 Server
CVE-2025-54441Same product: Samsung Magicinfo 9 Server
CVE-2025-54439Same product: Samsung Magicinfo 9 Server

Affected Assets

samsung
magicinfo 9 server
≤ 21.1080.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly addresses path traversal by requiring validation of pathname inputs to prevent access to restricted directories and subsequent code injection.

SI-2 Flaw Remediation good match
prevent

Mandates timely remediation of the specific flaw in MagicINFO 9 Server versions less than 21.1080.0 through patching or updates.

AC-3 Access Enforcement partial match
prevent

Enforces logical access controls to restrict file and directory access, mitigating unauthorized traversal even if input validation fails.

References