CVE-2025-4632: Samsung MagicINFO 9 Server Path Traversal Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2025-05-22
EPSS: 24.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-05-13 · updated 2026-06-17
Weakness: CWE-22

Description

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.

Affected products

Samsung Electronics MagicINFO 9 Server: before 21.1052.0 — fixed in 21.1052.0

How to fix

Upgrade to a fixed version: Samsung Electronics MagicINFO 9 Server 21.1052.0. Check the vendor advisory for mitigations.

References

https://security.samsungtv.com/securityUpdates#SVP-MAY-2025
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4632

Get alerted when CVE-2025-4632 or the next vulnerability affects your stack