PT-2025-30537 · Samsung · Magicinfo 9 Server

Published 2025-07-23 · Updated 2025-07-28 · CVE-2025-54449

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MagicINFO 9 Server versions prior to 21.1080.0

Description A code injection issue exists due to the unrestricted upload of files with dangerous types. This allows for potential code execution.

Recommendations Update to version 21.1080.0.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-54449

ZDI-25-665

Affected Products

Magicinfo 9 Server

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-54449 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54449 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-665 · Security Note
• https://security.samsungtv.com/securityUpdates · Vendor Advisory
• https://twitter.com/CVEnew/status/1947905644549357683 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1947942478465622084 · Twitter Post
• https://twitter.com/CveFindCom/status/1947894618583966206 · Twitter Post
• https://twitter.com/TheZDIBugs/status/1949943166116708806 · Twitter Post
• https://t.me/CVEtracker/28465 · Telegram Post