Vulnerability record · CVE-2025-4632 · published 13 May 2025
CVE-2025-4632: Samsung MagicINFO 9 Server path traversal allows arbitrary file write
Samsung · Magicinfo 9 Server
Samsung MagicINFO 9 Server before version 21.1052 contains a path traversal flaw (CWE-22) that lets an attacker write arbitrary files with system authority. Because the server is network-facing and the write occurs at system privilege level, a successful attack can lead to full compromise of the host.
Description
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or interaction required, confirmed exploitation in CISA KEV, and arbitrary file write as system authority make this an urgent patching priority.
What it is
Samsung MagicINFO 9 Server before version 21.1052 contains a path traversal flaw (CWE-22) that lets an attacker write arbitrary files with system authority. Because the server is network-facing and the write occurs at system privilege level, a successful attack can lead to full compromise of the host.
Impact
An attacker can write arbitrary files as system authority, which typically enables planting executables, overwriting configuration, or achieving remote code execution on the server.
Attack surface
Reachable over the network via the MagicINFO 9 Server interface; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.
Exploitation
CVE-2025-4632 was added to CISA KEV on 2025-05-22, confirming exploitation in the wild, and EPSS shows a 30-day probability of roughly 24 percent (97.7th percentile). No ransomware campaign use is documented.
What to do
- Upgrade Samsung MagicINFO 9 Server to version 21.1052 or later per the vendor advisory.
- If patching is not immediately possible, restrict network access to the MagicINFO 9 Server to trusted management networks only.
- Follow CISA BOD 22-01 guidance or discontinue use of the product if mitigations are unavailable.
- Audit the server for unexpected files or modifications in web-accessible and system directories after patching.
Detection
- Monitor server and web logs for path traversal sequences (../, encoded variants) in file upload or write requests.
- Alert on new or modified executable files in MagicINFO 9 Server directories and system paths.
- Watch for unexpected outbound connections or child processes spawned by the MagicINFO service.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2025-4632 to the Known Exploited Vulnerabilities catalog on 22 May 2025 as "Samsung MagicINFO 9 Server Path Traversal Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 12 June 2025.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://security.samsungtv.com/securityUpdates#SVP-MAY-2025 | PatchVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4632 | US Government Resource |
Track CVE-2025-4632 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2025-4632), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
