The flaw in Samsung MagicINFO 9 Server stems from incorrect default permissions on critical files and directories, allowing a local attacker to elevate privileges beyond what the service configuration intended. This privilege escalation weakness, identified as CWE‑276, could enable a compromised user to gain root or administrator rights, thereby threatening the confidentiality, integrity, and availability of the entire system.

Samsung Electronics MagicINFO 9 Server deployments running any version earlier than 21.1091.1 are affected. Upgrades or patches applied to versions 21.1091.1 and newer resolve the issue.

With a CVSS score of 7.8 the vulnerability is classified as high severity; EPSS data is unavailable and it does not appear in the CISA KEV catalog. The flaw requires local access or a compromised user account, so it is a local attack vector. While no public exploit is known, the potential impact warrants prompt remediation.