Samsung MagicINFO 9 Server Unrestricted File Upload Vulnerability Allowing Code Injection

A vulnerability in Samsung Electronics MagicINFO 9 Server, versions prior to 21.1080.0, allows for unrestricted file uploads of dangerous types, leading to code injection. This issue arises from inadequate restrictions on file upload capabilities, enabling the injection of malicious code into the server.

Impact

Exploitation of this vulnerability could result in unauthorized code execution on the server.

Remediation

Users can check for the latest firmware updates through the Samsung Smart TV update settings. For Samsung Visual Displays, security patches are being released. If the default update settings are enabled, the latest firmware will have been automatically installed. Otherwise, new firmware versions can be downloaded from the Samsung website.