Samsung MagicINFO 9 Server Unrestricted File Upload Vulnerability Allowing Code Injection

A vulnerability in Samsung Electronics MagicINFO 9 Server, versions prior to 21.1080.0, allows for unrestricted file uploads of dangerous types, leading to code injection. This issue arises from improper validation of uploaded files, enabling the execution of malicious code on the server.

Impact

Exploitation of this vulnerability could result in unauthorized code execution on the server where MagicINFO 9 Server is installed.

Remediation

Users can check for the latest firmware updates on the Samsung website. If the default update settings are enabled, the latest version will have been automatically installed. For specific patch information related to this vulnerability, refer to the Samsung Security Vulnerability Patch (SVP) program.