CVE-2025-4632

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-4632 9.8

Samsung · MagicINFO 9 Server · Added 2025-05-22 · Published 2025-05-13

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilitySamsung MagicINFO 9 Server Path Traversal Vulnerability

VendorSamsung

ProductMagicINFO 9 Server

Date added2025-05-22

Due date2025-06-12

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-22

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Samsung MagicINFO 9 Server contains a path traversal vulnerability that allows an attacker to write arbitrary file as system authority.

NVD: Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-03 14:43 UTC

Wall time0.5s

Searches5

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2025-4632
https://ssd-disclosure.com/ssd-advisory-samsung-magicinfo-unauthenticated-rce/
https://arcticwolf.com/resources/blog/follow-up-samsung-patches-zero-day-vulnerability-magicinfo-9-server-cve-2025-4632/
https://censys.com/advisory/cve-2025-4632/
https://www.huntress.com/blog/rapid-response-samsung-magicinfo9-server-flaw
https://www.sentinelone.com/vulnerability-database/cve-2025-4632/
https://www.darkreading.com/endpoint-security/attackers-target-samsung-magicinfo-server-bug
https://github.com/digitalsurgn/CVE-2025-4632_POC
https://security.samsungtv.com/securityUpdates#SVP-MAY-2025
https://eu.community.samsung.com/t5/samsung-solutions/update-magicinfo-server-v9-21-1052-0-setup-file/ta-p/11374265
https://www.quorumcyber.com/threat-intelligence/critical-vulnerability-in-samsungs-magicinfo-server-fixed/

Hunting hypothesis agent

Hunt Tomcat access logs for POSTs to /MagicInfo/servlet/SWUpdateFileUploader with fileName containing ./../ traversal — the servlet writes .jsp webshells to the web root without auth, enabling unauthenticated SYSTEM RCE

Research details

Component/MagicInfo/servlet/SWUpdateFileUploader (com.samsung.magicinfo.protocol.file.SWUpdateFileUploadServlet) - file upload servlet

PreconditionsNetwork access to Samsung MagicINFO 9 Server on port 7002 (default HTTPS). No authentication required. The vulnerable endpoint /MagicInfo/servlet/SWUpdateFileUploader accepts a fileName parameter without path traversal sanitization. The servlet concatenates the fileName parameter with a base directory path without validating directory traversal sequences (../../). No file extension validation is performed, enabling JSP webshell upload. The Apache Tomcat process runs with SYSTEM privileges. Fixed in version 21.1052. agent

DeliveryHTTP requests with directory traversal sequences

Public PoCyes

PoC URLs https://ssd-disclosure.com/ssd-advisory-samsung-magicinfo-unauthenticated-rce/
https://github.com/digitalsurgn/CVE-2025-4632_POC
https://www.huntress.com/blog/rapid-response-samsung-magicinfo9-server-flaw Third-party repos; verify before use.

Advisoryhttps://security.samsungtv.com/securityUpdates#SVP-MAY-2025

Exploit notesCVSS attack complexity: LOW. CRITICAL severity (CVSS 9.8). Unauthenticated exploitation via HTTP POST to /MagicInfo/servlet/SWUpdateFileUploader. The servlet reads the fileName parameter via HttpServletRequest.getParameter() and concatenates it to a base directory path without calling the directoryTraversalChecker method. No authentication check, no file extension validation. Attackers can upload JSP webshells to the web root (/MagicInfo/) and achieve remote code execution as SYSTEM on the Apache Tomcat process. This vulnerability bypasses the incomplete fix for CVE-2024-7399. Actively exploited in the wild by Mirai botnet operators shortly after PoC publication.

SummaryCVE-2025-4632 is a critical (CVSS 9.8) path traversal vulnerability in Samsung MagicINFO 9 Server (versions prior to 21.1052) that allows unauthenticated attackers to write arbitrary files with SYSTEM privileges. The vulnerable endpoint /MagicInfo/servlet/SWUpdateFileUploader accepts a fileName parameter without path sanitization, allowing directory traversal (../../) sequences to write JSP webshells to the web root. This vulnerability bypasses the incomplete fix for CVE-2024-7399 and was actively exploited in the wild by Mirai botnet operators shortly after SSD Disclosure published a PoC. Samsung released version 21.1052.0 to address the issue.

Tia coverage

First reported2026-09-24

First exploit report2026-09-24

Exploit report → KEV490 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

threat-actor-compiles-cryptominer-on-endpoint-via-samsung-magici

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.