PT-2026-5607 · Samsung · Magicinfo 9 Server

Published 2026-02-02 · Updated 2026-03-10 · CVE-2026-25202

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MagicINFO 9 Server versions prior to 21.1090.1

Description The database account and password are hardcoded, which allows login with the account to manipulate the database. This compromises the integrity and confidentiality of the database.

Recommendations Update MagicINFO 9 Server to version 21.1090.1 or later.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2026-01068

CVE-2026-25202

Affected Products

Magicinfo 9 Server

References · 14

• https://osv.dev/vulnerability/CVE-2026-25202 · Vendor Advisory
• https://security.samsungtv.com/securityUpdates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25202 · Security Note
• https://bdu.fstec.ru/vul/2026-01068 · Security Note
• https://twitter.com/CveFindCom/status/2018205550098493757 · Twitter Post
• https://twitter.com/TheHackerWire/status/2018193252680442353 · Twitter Post
• https://t.me/cveNotify/150536 · Telegram Post
• https://twitter.com/SystemTek_UK/status/2018327923061645445 · Twitter Post
• https://t.me/cveNotify/154958 · Telegram Post
• https://twitter.com/cracbot/status/2020090205987041578 · Twitter Post
• https://thehackerwire.com/magicinfo-9-server-hardcoded-db-creds-expose-data · Note
• https://twitter.com/vuldb/status/2018237256340013455 · Twitter Post
• https://t.me/CVEtracker/43452 · Telegram Post
• https://twitter.com/PurpleOps_io/status/2019261157324804417 · Twitter Post