Log in / Sign up

Vulnerability details

CVE-2025-4632

Actively exploited
Samsung Electronics MagicINFO 9 Server
CVSS 3.1
9.8Critical

Remedy

Required action (CISA): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (due: 2025-06-12)

Versions not listed as affected in the CVE record:
  • MagicINFO 9 Server — version 21.1052 and later

Official description

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.

CVSS scores

ScoreVersionSourceVector
9.8Critical 3.1 CVEProject cvelistV5 (CNA) (samsung.tv_appliance) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

VendorProductVersionsSource
Samsung Electronics MagicINFO 9 Server v < 21.1052 CVEProject cvelistV5 (CNA)

References and advisories

2
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2025-05-13
Last updated
2026-02-26
State
Published
Assigner (CNA)
samsung.tv_appliance
Kolun priority
79 · High

CISA KEV catalog

Date added
2025-05-22
Due date
2025-06-12
Used in ransomware
Unknown

Exploit prediction (EPSS)

24.06%
Probability of exploitation in 30 days
97.8%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
Active
Technical impact
Total

Weaknesses (CWE)

  • CWE-22
    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')