Samsung MagicINFO 9 Server Path Traversal Vulnerability Allowing Web Shell Upload

A path traversal vulnerability has been identified in Samsung Electronics MagicINFO 9 Server versions prior to 21.1080.0. This vulnerability allows attackers to upload a web shell to the web server by improperly limiting a pathname to a restricted directory.

Impact

Exploitation of this vulnerability could lead to unauthorized file uploads, allowing for the execution of malicious scripts on the web server.

Remediation

Users can check for the latest firmware updates through the Samsung Smart TV software update support policy, which guarantees updates for at least five years from the product launch. For MagicINFO 9 Server, the latest security vulnerability patch is available as part of the SVP-MAY-2025 update.