PT-2026-5606 · Samsung · Magicinfo 9 Server

Published 2026-02-02 · Updated 2026-03-10 · CVE-2026-25201

Positive Technologies · (AI Summary)

CVSS v2.0

10

High

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MagicINFO 9 Server versions prior to 21.1090.1

Description An unauthenticated user can upload arbitrary files, potentially leading to remote code execution and privilege escalation. The issue allows for the upload of files without authentication, which can then be used to execute code on the system.

Recommendations Update MagicINFO 9 Server to version 21.1090.1 or later.

Fix

LPE

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2026-01070

CVE-2026-25201

Affected Products

Magicinfo 9 Server

References · 12

• https://security.samsungtv.com/securityUpdates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25201 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25201 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01070 · Security Note
• https://twitter.com/CveFindCom/status/2018205568335241560 · Twitter Post
• https://twitter.com/PurpleOps_io/status/2019261157324804417 · Twitter Post
• https://twitter.com/TheHackerWire/status/2018193301976019133 · Twitter Post
• https://t.me/CVEtracker/43451 · Telegram Post
• https://t.me/cveNotify/150535 · Telegram Post
• https://t.me/cveNotify/154957 · Telegram Post
• https://twitter.com/cracbot/status/2019365463181209962 · Twitter Post
• https://twitter.com/cracbot/status/2020090204426760563 · Twitter Post