CVE-2025-54454 is a critical (CVSS 9.1) use of hard coded credentials in Samsung MagicINFO 9 Server that allows authentication bypass. Versions below 21.1080.0 are affected. Update to 21.1080.0 or later and keep the console off the internet. The sections below cover who is affected, how to check, and what to do first.
What's affected
- MagicINFO 9 Server below 21.1080.0 is affected, per the record.
- Confirm the fixed build in Samsung's bulletin.
- CVE-2025-54455 is a second hard coded credentials entry with the same boundary.
The record lists CVSS 9.1 (Critical). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Read the server version in the admin console and compare it with 21.1080.0. Check whether the console answers from outside your network. Review sign in logs for unfamiliar activity.
What to do now
- Upgrade to 21.1080.0 or later.
- Restrict console access to a VPN or allow list.
- Rotate every administrative and service credential after upgrading.
- Review accounts, content and scheduled jobs for changes you did not make.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The weakness is CWE-798. A credential built into a product is the same on every install, so anyone who learns it can use it against every exposed server. It cannot be rotated by the owner, only removed by the vendor.
The record does not flag KEV status. Because the secret is shared across installs, scanners can try it at scale, so do not rely on obscurity.
Severity scores are a starting point. The score for this entry is 9.1, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
Can I change the hard coded credential?
Not by configuration. The vendor fix removes it.
Is this related to CVE-2025-54455?
They are separate entries with the same weakness class and the same fix boundary.
Sources
Last reviewed: 18 October 2026.
