The vulnerability originates from hardcoded database credentials embedded in MagicINFO 9 Server, allowing an authenticated user to log in with a privileged account and manipulate the underlying database. This flaw enables an attacker to read, alter, or delete data, potentially leading to loss of confidentiality, integrity, and availability. The weakness aligns with CWE-798, reflecting the use of fixed credentials that compromise authentication security.

The affected product is Samsung Electronics MagicINFO 9 Server. All versions older than 21.1090.1 contain the hardcoded credentials and are therefore vulnerable.

The CVSS score of 9.8 indicates a high severity risk. Although the EPSS score is reported as less than 1%, suggesting low current exploitation probability, the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker who can reach the server's login interface could exploit the hardcoded credentials to gain administrative database access. No explicit evidence indicates remote unauthenticated exploitation; the primary attack vector appears to be local or remote login by an authenticated user.