Actively exploited · Published May 13, 2025 · Assigned by samsung.tv_appliance
CVE-2025-4632
Critical 9.8 Exploited
In plain English
A critical-severity path traversal in MagicINFO 9 Server from Samsung Electronics. Attackers are actively exploiting it in the wild (listed by CISA on May 22, 2025). The chance it is exploited in the next 30 days is estimated at 24.1% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Jun 12, 2025.
Official description
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Samsung Electronics | MagicINFO 9 Server | 0 – before 21.1052 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H