CVE-2025-54450 is a high severity (CVSS 7.2) path traversal in Samsung MagicINFO 9 Server that allows code injection. Versions below 21.1080.0 are affected. Install the fixed build listed in Samsung's security updates page and restrict console access. The sections below cover who is affected, how to check, and what to do first.
What's affected
- MagicINFO 9 Server below 21.1080.0 is affected, per the record.
- Confirm the fixed build in Samsung's bulletin.
The record lists CVSS 7.2 (High). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Read the server version in the admin console and compare it with 21.1080.0. Note whether the console is reachable from outside.
What to do now
- Upgrade to 21.1080.0 or later.
- Restrict console access to management networks.
- Review file system changes under the application directories since your last known good state.
- Check the sibling CVE-2025-54453, which is a second path traversal with the same fix boundary.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The weakness is CWE-22. Path traversal lets input steer a file operation outside the folder the code intended. In server software it can turn a file write into code execution.
The CVSS vector is lower than its sibling CVE-2025-54453. The record gives the score as 7.2, so the two should be triaged separately but fixed together.
Severity scores are a starting point. The score for this entry is 7.2, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
Why do two path traversal CVEs share the same fix version?
Samsung addressed several flaws in 21.1080.0. The record lists each one separately.
Do I need to act on both?
One upgrade covers them, per the shared boundary in the record.
Sources
Last reviewed: 18 October 2026.
