Samsung MagicINFO 9 Server Unrestricted File Upload Vulnerability Allowing Code Injection

A vulnerability in Samsung Electronics MagicINFO 9 Server, versions prior to 21.1080.0, allows for unrestricted file uploads of dangerous types, leading to code injection. This issue arises from inadequate restrictions on file upload functionalities, enabling the injection of malicious code into the server.

Impact

Exploitation of this vulnerability could result in unauthorized code execution on the server.

Remediation

Users can check for the latest firmware updates on the Samsung website. If the default update settings are enabled, the latest firmware will have been automatically installed. For specific update information, consult the Samsung Security Vulnerability Patch (SVP) schedule.