CVE-2025-4632
Samsung MagicINFO 9 Server Path Traversal Vulnerability
Description
CVE-2025-4632 is a critical path traversal vulnerability in Samsung MagicINFO 9 Server that allows unauthenticated attackers to write arbitrary files with system-level authority. The vulnerability stems from improper limitation of a pathname to a restricted directory, enabling attackers to escape the intended file path and write malicious files to any location on the server. With a CVSS v3.1 score of 9.8 (CRITICAL), no authentication or user interaction required, and an EPSS score of 42.68% at the 97.39th percentile, CVE-2025-4632 represents a severe threat to organizations running Samsung's digital signage management platform. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 12, 2025.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| samsung | magicinfo 9 server | < 21.1052.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://security.samsungtv.com/securityUpdates#SVP-MAY-2025(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4632(US Government Resource)
Weakness Type
CWE-22: Path Traversal
CVE-2025-4632 is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal or directory traversal. In Samsung MagicINFO 9 Server, the application fails to properly validate file paths in write operations, allowing attackers to use directory traversal sequences (such as ../) to write files to arbitrary locations outside the intended directory. Because these operations execute with system-level authority, the attacker can write files anywhere on the server file system.
Learn more: CWE-22 — Path Traversal
Impact Analysis
CVE-2025-4632 has maximum impact potential due to its unauthenticated arbitrary file write capability with system privileges. The vulnerability is network-accessible (AV:N) with low complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N). Confidentiality (High): While the primary vulnerability is a file write, achieving code execution through writing web shells or scheduled tasks grants full read access to all data on the server, including digital signage content, credentials, network configuration, and any sensitive data managed by the MagicINFO platform. Integrity (High): Arbitrary file write with system authority allows overwriting critical system files, modifying application configurations, planting web shells for persistent access, altering digital signage content across all managed displays, and potentially deploying malware to managed signage endpoints. Availability (High): An attacker can overwrite system files to crash the server, corrupt the MagicINFO database, or disable the digital signage management service affecting all connected displays. The EPSS score of 42.68% at the 97.39th percentile confirms very high exploitation activity.
Exploit Maturity
CVE-2025-4632 has high exploit maturity with confirmed active exploitation. CISA has added the vulnerability to the Known Exploited Vulnerabilities catalog, confirming real-world attacks. The EPSS score of 42.68% at the 97.39th percentile places it among the top 2.6% of vulnerabilities by exploitation probability. The Samsung security advisory (SVP-MAY-2025) provides the vendor disclosure and patch information. MagicINFO 9 Server is a centralized management platform for Samsung digital signage displays, commonly deployed in retail, hospitality, healthcare, and corporate environments. The combination of internet-facing deployment, unauthenticated exploitation, and system-level file write makes this vulnerability extremely attractive to attackers seeking initial network access.
Remediation
-
Update Samsung MagicINFO 9 Server to version 21.1052.0 or later immediately. The patch is available through the Samsung Security Updates portal. Verify the installed version and confirm the update was applied successfully.
-
Restrict network access to the MagicINFO 9 Server to trusted management networks only. Do not expose the server's web interface directly to the internet. Implement firewall rules and network segmentation to limit access to authorized administrators and managed display endpoints.
-
Conduct forensic analysis on servers running vulnerable versions. Search for unauthorized files, particularly web shells (PHP, JSP, ASPX files in web-accessible directories), modified system files, scheduled tasks, new user accounts, and any files created or modified around the time the server was exposed to untrusted networks.
-
Review all managed signage content for unauthorized modifications. If the MagicINFO server was compromised, attackers could have altered content distributed to digital displays, potentially displaying malicious or inappropriate content across the organization's signage network.
-
Implement file integrity monitoring on the MagicINFO server to detect unauthorized file creation or modification. Deploy an intrusion detection system configured to alert on path traversal patterns in network traffic targeting the MagicINFO application.
Technical Details
CVE-2025-4632 is a path traversal vulnerability in Samsung MagicINFO 9 Server versions prior to 21.1052.0. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the most critical exploitation profile: unauthenticated, network-accessible, low complexity, and maximum impact. The vulnerability exists in the server's file handling logic, where pathname validation fails to prevent directory traversal sequences from escaping the intended restricted directory. When processing file upload or file write operations, the application does not properly canonicalize or validate the destination path, allowing attackers to include ../ sequences or equivalent path manipulation techniques to target arbitrary locations on the file system. Critically, the file write operations execute with system-level authority rather than restricted application permissions, meaning the attacker can write to any location including system directories, web server roots, and startup locations. This effectively converts a file write primitive into reliable remote code execution by writing web shells or placing executables in auto-start locations.
Frequently Asked Questions
Is CVE-2025-4632 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2025-4632. The EPSS score of 42.68% at the 97.39th percentile indicates very high exploitation activity. Organizations should treat this as an emergency requiring immediate patching.
What products are affected by CVE-2025-4632?
Samsung MagicINFO 9 Server versions before 21.1052.0 are affected. This is a centralized management platform for Samsung digital signage displays deployed across enterprise environments.
How do I fix CVE-2025-4632?
Update Samsung MagicINFO 9 Server to version 21.1052.0 or later. Immediately restrict network access to the server and conduct forensic analysis for signs of compromise on exposed systems.
How severe is CVE-2025-4632?
CVE-2025-4632 is rated CRITICAL with a CVSS score of 9.8. It allows unauthenticated remote attackers to write arbitrary files with system privileges, which trivially leads to complete server compromise through web shell deployment.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.