Signage Hijack: Samsung MagicInfo9 Flaws (CVSS 9.8) Expose Servers

Samsung’s MagicInfo9 Server, a widely used solution for managing digital signage displays, has been struck by a trio of devastating security vulnerabilities. Two of the flaws carry a critical CVSS score of 9.8, essentially leaving the server wide open to complete takeover by unauthenticated attackers.

The vulnerabilities, which affect all versions of MagicINFO 9 Server prior to 21.1090.1, range from amateurish hardcoded passwords to dangerous remote code execution (RCE) bugs. For organizations using these servers to control public displays, the risk is not just digital defacement—it is total network compromise.

The most glaring oversight is CVE-2026-25202 (CVSS 9.8), a hardcoded credential vulnerability that effectively hands intruders the keys to the kingdom.

The database account and password were found to be “hardcoded, allowing login with the account to manipulate the database.” This means an attacker doesn’t need to hack the system; they just need to know the default credentials baked into the code. Once logged in, they have unfettered access to read, write, or delete the entire database, potentially disrupting operations or stealing sensitive data.

The second flaw, CVE-2026-25201 (CVSS 8.8), opens the door for Remote Code Execution (RCE). The vulnerability allows an “unauthenticated user [to] upload arbitrary files to execute remote code.”

In a typical attack scenario, a threat actor could upload a malicious script (such as a web shell) to the server. Because the server fails to validate the user or the file type, it executes the script, granting the attacker a foothold in the system. From there, the flaw enables “privilege escalation,” allowing the intruder to move from a low-level access point to full administrative control.

The third flaw is CVE-2026-25200 (CVSS 9.8), a vulnerability that turns the server’s own features against it. The flaw allows users to “upload HTML files without authentication,” leading to Stored Cross-Site Scripting (XSS).

While XSS is often viewed as a client-side annoyance, in this context, it is a critical threat. By uploading a malicious HTML file, an attacker can trap legitimate administrators. When an admin views the file, the malicious script executes in their browser, potentially stealing session cookies or credentials. As the report warns, this “can result in account takeover,” giving the attacker full control over the MagicInfo management console.

Samsung has addressed these vulnerabilities in the latest update. Administrators running MagicInfo9 Server must check their version number immediately. If you are running any version less than 21.1090.1, your infrastructure is vulnerable.

The path to safety is a direct upgrade. Moving to version 21.1090.1 or later eliminates these risks, removing the hardcoded credentials and closing the upload loopholes.

Related Posts:

• No More Public BSODs: Windows 11 Will Hide Crash Screens on Public Displays
• Critical CVE-2025-4632 Flaw in Samsung MagicINFO Puts Global Signage Networks at Risk
• Hardcoded Cloud Credentials Found in Popular Mobile Apps: A Major Security Flaw
• Chrome Extension Security Alert: Hidden API Keys Expose 21M+ Users to Risk!