CVE-2025-4632

Critical9.8Published on May 13, 2025

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.

Actively exploited

In the CISA exploited-vulnerabilities catalogue since May 22, 2025
US federal agencies must remediate it by Jun 12, 2025 (BOD 22-01)
Attacked 7 days before the vulnerability was made public
Confirmed by sensors, not only by reports

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Source: CISA KEV · Oct 1, 2026 Sep 30, 2026 Sep 29, 2026 Sep 28, 2026 Sep 24, 2026 Sep 16, 2026

CVSS score9.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-22, CWE-22

Vendorssamsung

Affected products

Vendors	Product	Versions
samsung	magicinfo 9 server	< 21.1052.0

Vulnerabilities

Three Execution Paths Expose Trust Failures in Zammad, MagicINFO, and Unsloth Studio

Zammad session hijack led to root at DIVD, MagicINFO flaw enabled AnyDesk and cryptomining, and Unsloth executed code on model selection.

Oct 2, 202603:376 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Actively exploited

Affected products

Related articles

Three Execution Paths Expose Trust Failures in Zammad, MagicINFO, and Unsloth Studio