CVE Intelligence
Analysis AI-assisted

CVE-2026-25202: Samsung MagicINFO 9 Server Hard-coded Database Credentials

Samsung MagicINFO 9 Server versions below 21.1090.1 contain a hard-coded database account and password, according to the record. Login with that account can be used to manipulate the database. The CNA reports a CVSS 3.1 base score of 9.8, and the sources consulted show no confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-25202 is classified as CWE-798, Use of Hard-coded Credentials. The record states that the database account and its password are hardcoded in Samsung MagicINFO 9 Server, so logging in with that account allows manipulation of the database. The CNA is Samsung PSIRT and the record was published on 2026-02-02.

Impact

  • The CNA assigns a CVSS 3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates a network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
  • Inference: data stored in the product's database could be read, altered or removed by anyone who uses the embedded account.
  • Unknown: the record does not say whether the credential can be changed without a product update.

Affected products and versions

  • Samsung MagicINFO 9 Server, versions less than 21.1090.1, according to the record.
  • The record lists no fixed version entries. This does not mean no fix exists; the vendor advisory page should be checked.

Exploitation status

The record shows this CVE is not listed in CISA KEV and has no EPSS score. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Review the Samsung security updates page for the MagicINFO 9 Server update that addresses this issue.
  • Inventory MagicINFO 9 Server deployments and identify those running versions below 21.1090.1.
  • Limit network access to the MagicINFO server and its database to trusted hosts and administrators.
  • Until an update is applied, review database account activity and reduce exposure of the management interface.

Detection guidance

  • Review database logs for logins by the application account from unexpected hosts or at unusual times.
  • Monitor for unexpected changes to records managed by MagicINFO.
  • Alert on database connections that do not originate from the MagicINFO server.

Limitations of the available information

  • The record does not identify the database engine, the exact component containing the credential, or the update that resolves the issue.
  • No fixed version, KEV status or EPSS score is available in the record.
  • Only one vendor reference is listed, and its content was not reviewed for this analysis.

Frequently asked questions

What is CVE-2026-25202?

It is a hard-coded credential issue in Samsung MagicINFO 9 Server. The database account and password are embedded in the product, so logging in with that account can manipulate the database.

Which versions are affected?

According to the record, versions less than 21.1090.1 are affected. The record lists no fixed version, so the vendor advisory should be checked.

Is this CVE being actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.