The flaw allows an unauthenticated user to upload arbitrary files, enabling remote code execution and privilege escalation through the MagicInfo9 Server web interface. This is a high‑severity file‑upload vulnerability (CWE-434). The impact spans the entire affected instance, potentially giving attackers full control over the server and data it hosts.

Samsung Electronics' MagicINFO 9 Server is vulnerable when its version is lower than 21.1090.1. No other vendor or product is listed as affected. All installations running an earlier version carry the same risk.

The CVSS score of 8.8 indicates a high severity, and the EPSS score of less than 1% suggests low, but non‑zero, likelihood of current exploitation. The issue is not listed in the CISA KEV catalog, meaning no public exploitation evidence is reported yet. The attack path is straightforward: an unauthenticated user uploads a crafted file via the server’s file‑upload endpoint; because the application accepts any file type, an attacker can place a malicious script that the server will later execute, granting full administrative privileges.