⚠ Actively exploited
Added to CISA KEV on 2025-05-22. Federal agencies required to patch by 2025-06-12. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable..
CVE-2025-4632 — Path Traversal in Electronics Magicinfo 9 Server
Severity
9.8CRITICALNVD
EPSS
49.2%
top 2.21%
CISA KEV
KEV
Added 2025-05-22
Due 2025-06-12
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedMay 13
KEV addedMay 22
KEV dueJun 12
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages2 packages
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-cmww-723f-496g: Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21↗2025-05-13
CVEList▶
CVE-2025-4632: Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21↗2025-05-13
💥Exploits & PoCs
1Nuclei▶
Samsung MagicINFO 9 Server - File Upload & Remote Code Execution