CVE-2025-54447 is a high severity (CVSS 8.1) unrestricted upload of a dangerous file type in Samsung MagicINFO 9 Server, leading to code injection. Versions below 21.1080.0 are affected. Apply the fixed build from Samsung's security updates page. The sections below cover who is affected, how to check, and what to do first.
What's affected
- MagicINFO 9 Server below 21.1080.0 is affected, per the record.
- Confirm the exact fixed build in Samsung's bulletin.
The record lists CVSS 8.1 (High). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Read the server version in the MagicINFO admin console and compare it with 21.1080.0.
Check which accounts can upload content and whether the server is reachable from outside your management network.
What to do now
- Upgrade to MagicINFO 9 Server 21.1080.0 or later.
- Limit who can upload content and review recent uploads for unexpected file types.
- Restrict access to the server to trusted networks.
- Monitor the server for new files in web accessible folders.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The weakness is CWE-434. An upload feature must check what kind of file arrives and where it is stored. If an executable file type can be saved somewhere the server will run it, an upload becomes code execution.
Signage servers sit on corporate networks and push content to many screens, so a compromise reaches further than one machine.
Severity scores are a starting point. The score for this entry is 8.1, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
What does code injection mean here?
The record says the upload flaw allows code injection. It gives no further technical detail, so check Samsung's bulletin.
Is there a workaround?
The record names none. Update, and restrict network access in the meantime.
Sources
Last reviewed: 18 October 2026.
