CVE-2025-54445 is a high severity (CVSS 8.2) improper restriction of XML external entity reference in Samsung MagicINFO 9 Server, which allows server side request forgery. Versions below 21.1080.0 are affected. Apply the update listed in Samsung's security bulletin. The sections below cover who is affected, how to check, and what to do first.
What's affected
- MagicINFO 9 Server below 21.1080.0 is affected, per the record.
- The record does not name a fixed version explicitly; 21.1080.0 is the boundary. Confirm the fixed build in Samsung's security updates page.
The record lists CVSS 8.2 (High). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Sign in to the MagicINFO server admin console and read the server version. Compare it with 21.1080.0.
Also check whether the console is reachable from the internet. Digital signage servers are often published for remote management.
What to do now
- Read Samsung's security updates page and identify the fixed MagicINFO 9 build.
- Back up the server configuration and database.
- Upgrade to 21.1080.0 or later.
- Restrict the console to management networks.
- Review the other MagicINFO 9 CVEs published the same day, since they share the same fix boundary.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The weakness is CWE-611, XML external entity reference. When an XML parser resolves external entities, a document can make the server fetch resources on the attacker's behalf. That is the SSRF the record mentions: the server becomes a proxy into networks the attacker cannot reach.
The same release fixes several other MagicINFO 9 flaws, including authentication bypass and file handling issues. Patching once closes the whole set.
Severity scores are a starting point. The score for this entry is 8.2, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
Are other MagicINFO CVEs fixed in the same version?
The record shows several CVEs with the same boundary of less than 21.1080.0, so one upgrade should address them. Confirm in the Samsung bulletin.
Is it exploited in the wild?
The record does not flag it as KEV, and Samsung's entry in the record does not say so.
Sources
Last reviewed: 18 October 2026.
