CVE-2025-54453 is a high severity (CVSS 8.8) path traversal in Samsung MagicINFO 9 Server that allows code injection. Versions below 21.1080.0 are affected. Apply the fixed build from Samsung's security updates page and keep the console off untrusted networks. The sections below cover who is affected, how to check, and what to do first.
What's affected
- MagicINFO 9 Server below 21.1080.0 is affected, per the record.
- Confirm the fixed build in Samsung's bulletin.
The record lists CVSS 8.8 (High). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Read the server version in the admin console and compare it with 21.1080.0. Check whether the console is exposed beyond your management network.
What to do now
- Upgrade to 21.1080.0 or later.
- Restrict console access.
- Review the application directories for files you did not place there.
- Also address CVE-2025-54450, the other path traversal with the same boundary.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The weakness is CWE-22. This entry scores 8.8 where its sibling scores 7.2, which suggests different privilege requirements in the vector. Read the record's vector for the detail.
Path handling bugs repeat inside a codebase. After fixing one, teams should search for other places that build file paths from input.
Severity scores are a starting point. The score for this entry is 8.8, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
Why is this scored higher than CVE-2025-54450?
The record gives 8.8 for this one and 7.2 for the other. The vectors differ, so check them.
Does a single upgrade fix both?
Per the shared boundary of less than 21.1080.0, yes.
Sources
Last reviewed: 18 October 2026.
