Arbitrary File Upload in MagicINFO 9 Server Enables RCE

Publication date: 2026-02-02

Last updated on: 2026-03-10

Assigner: Samsung TV & Appliance

Description

An unauthenticated user can upload arbitrary files to execute remote code, leading to privilege escalation in MagicInfo9 Server. This issue affects MagicINFO 9 Server: less than 21.1090.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-02

Last Modified

2026-03-10

Generated

2026-07-06

AI Q&A

2026-02-02

EPSS Evaluated

2026-07-05

NVD

CVE-2026-25201

EUVD

EUVD-2026-5092

Affected Vendors & Products

Vendor	Product	Version / Range
samsung	magicinfo_9_server	to 21.1090.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability allows an unauthenticated user to upload arbitrary files to the MagicInfo9 Server, which can then be used to execute remote code. This can lead to privilege escalation on the affected server.

Impact Analysis

The vulnerability can lead to unauthorized remote code execution and privilege escalation, potentially allowing attackers to take control of the MagicInfo9 Server, compromise data, disrupt services, or perform malicious actions with elevated privileges.

Hi! I’m here to help you understand CVE-2026-25201. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70