Samsung MagicINFO 9 CVE-2025-4632

Vulnerability

Published 2026-09-24

Updated 2026-11-06

Verified 2026-11-06

Samsung MagicINFO 9 CVE-2025-4632 (CVSS 9.8, CISA KEV): path traversal → SYSTEM write

Samsung MagicINFO 9 Server CVE-2025-4632 is a path traversal / arbitrary file write as SYSTEM (incomplete fix lineage from CVE-2024-7399). NVD / Samsung PSIRT: CVSS 3.1 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); affected MagicINFO 9 Server before 21.1052; fixed May 2025. CISA KEV entry (added 2025-05-22; catalog still lists). (sources: Samsung TV / MagicINFO security updates; NVD)

Correction (06 Nov 2026): removed Huntress as a source; removed details no other source gives. (source: NVD)

Product

Samsung MagicINFO 9 Server (digital signage / content management; Tomcat)

Versions

Affected: MagicINFO 9 Server before 21.1052 (NVD/Samsung). Fixed May 2025 in 21.1052+. CVE-2024-7399 was an earlier related incomplete fix (Huntress).

CVSS

CVE-2025-4632

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AVAttack Vector: Network
ACAttack Complexity: Low
PRPrivileges Required: None
UIUser Interaction: None
SScope: Unchanged
CConfidentiality: High
IIntegrity: High
AAvailability: High

(CVSS 3.1 CRITICAL, Samsung PSIRT / NVD)

Exploited in Australia?

unknown

Patch to

Upgrade MagicINFO 9 Server to 21.1052 or later; remove internet exposure of signage management. Hunt IoCs: AnyDesk drops from 194.87.89.30, Silent XMR Miner Builder / compiler burst (csc.exe, gcc, tcc, donut), miner to auto.c3pool.org:19999, Defender tampering, unexpected local admin. CISA KEV: apply vendor mitigations or discontinue if unavailable.

vulnerabilities network