CVE-2026-25201
Published: 02 February 2026
Summary
CVE-2026-25201 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Samsung Magicinfo 9 Server. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and CM-7 (Least Functionality).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates file uploads at system entry points to reject dangerous file types, preventing unrestricted upload leading to RCE.
Restricts permitted actions without authentication, blocking unauthenticated access to file upload functionality.
Limits system to least functionality by prohibiting or restricting unnecessary unauthenticated file upload capabilities.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated arbitrary file upload to public-facing MagicINFO server directly enables T1190 for initial RCE access; results in privilege escalation via T1068; commonly achieved/persisted through web shell deployment (T1100).
NVD Description
An unauthenticated user can upload arbitrary files to execute remote code, leading to privilege escalation in MagicInfo9 Server. This issue affects MagicINFO 9 Server: less than 21.1090.1.
Deeper analysisAI
CVE-2026-25201 is a vulnerability in MagicINFO 9 Server versions less than 21.1090.1 that enables an unauthenticated user to upload arbitrary files, resulting in remote code execution and privilege escalation. Published on 2026-02-02, the issue is classified under CWE-434: Unrestricted Upload of File with Dangerous Type, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
An attacker can exploit this vulnerability remotely over the network without authentication, requiring low attack complexity but user interaction to trigger. Successful exploitation allows arbitrary code execution on the server, leading to privilege escalation and high impacts on confidentiality, integrity, and availability, with no change in scope.
Samsung's security advisory at https://security.samsungtv.com/securityUpdates provides details on patches and mitigation steps for this vulnerability.
Details
- CWE(s)