ZDI-CAN-28705: ZDI-26-268: Samsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability

Published Apr 15, 2026

Updated

This vulnerability allows local attackers to escalate privileges on affected installations of Samsung MagicINFO 9 Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-25203.

Affected Software

1 affected component

Samsung MagicINFO 9 Server

Event History

Apr 15, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-28705?

ZDI-CAN-28705 has a high severity level due to its potential to allow local privilege escalation.

How do I fix ZDI-CAN-28705?

To fix ZDI-CAN-28705, ensure you apply the latest patches and updates provided by Samsung for the MagicINFO 9 Server.

Who is affected by ZDI-CAN-28705?

ZDI-CAN-28705 affects installations of Samsung MagicINFO 9 Server that have incorrect default permissions.

What type of vulnerability is ZDI-CAN-28705?

ZDI-CAN-28705 is a local privilege escalation vulnerability.

What can an attacker do with ZDI-CAN-28705?

An attacker can escalate their privileges on affected installations of Samsung MagicINFO 9 Server if they already have low-privileged access.