CVE-2025-54452 is a high severity (CVSS 7.3) improper authentication flaw in Samsung MagicINFO 9 Server that allows authentication bypass. Versions below 21.1080.0 are affected. Update to 21.1080.0 or later using Samsung's security bulletin. The sections below cover who is affected, how to check, and what to do first.
What's affected
- MagicINFO 9 Server below 21.1080.0 is affected, per the record.
- Confirm the fixed build in Samsung's bulletin.
The record lists CVSS 7.3 (High). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Read the server version in the admin console and compare it with 21.1080.0. Review your access logs for sign ins you cannot match to a user.
What to do now
- Upgrade to 21.1080.0 or later.
- Put the console behind a VPN or an address allow list.
- Review user accounts and remove any you do not recognise.
- Rotate credentials for the server and for any integrations it holds.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The weakness is CWE-287, improper authentication. The record gives no mechanism beyond the class, so avoid guessing at one. What matters operationally is that a bypass makes every other control behind the login irrelevant.
Authentication flaws pair badly with file upload and path traversal flaws in the same product, and this release fixes several of each.
Severity scores are a starting point. The score for this entry is 7.3, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
How was authentication bypassed?
The record does not say. Samsung's bulletin is the place to check.
Is the issue exploited in the wild?
The record does not flag it as KEV.
Sources
Last reviewed: 18 October 2026.
