CVE-2025-4632

What it actually does

This is a high-severity path traversal vulnerability in Samsung MagicINFO 9 Server versions before 21.1052. The server fails to properly constrain attacker-controlled file paths to an intended directory, allowing an attacker to write files to arbitrary locations on the server. Because the write occurs with system-level authority, successful exploitation can result in web shell deployment, configuration tampering, persistence, service manipulation, and potentially full server compromise.

Why it matters to the business

An exposed or unpatched MagicINFO server can be taken over by attackers and used to disrupt digital signage operations, alter displayed content, steal credentials or configuration data, pivot further into the network, or host malware. This vulnerability is listed in CISA Known Exploited Vulnerabilities with active exploitation in the wild and a remediation due date of 2025-06-12, making it an urgent patching priority even though it is not currently identified by CISA as ransomware-used.

How an attack unfolds

An attacker first identifies an internet-accessible or reachable Samsung MagicINFO 9 Server running a vulnerable version before 21.1052. The attacker sends a crafted request containing path traversal sequences or encoded traversal characters to a vulnerable file-write function. Because the application does not adequately restrict the destination path, the server writes attacker-controlled content outside the intended directory using highly privileged permissions. In common post-exploitation scenarios, the attacker writes an executable script, JSP web shell, service configuration, scheduled task payload, or other malicious file into a location that will later be executed by the web server or operating system. The attacker then invokes the written file or waits for the service to load it, gaining command execution, persistence, or the ability to alter MagicINFO content and server state.

How to fix it

Upgrade Samsung MagicINFO 9 Server to version 21.1052 or later. If immediate patching is not possible, restrict access to the MagicINFO management interface using VPN, firewall rules, allowlists, or reverse proxy authentication; block public internet access; disable unnecessary upload or file-management functionality where feasible; run the service with the least privileged account possible; and monitor for unexpected files in web application, upload, temporary, startup, and service directories. Because exploitation is confirmed in the wild, treat vulnerable internet-exposed systems as potentially compromised until reviewed.

How to confirm the fix worked

Confirm the installed Samsung MagicINFO 9 Server version is 21.1052 or later using the application administration interface, vendor build metadata, installed package details, or file/version manifests. Verify that the server is not reachable from untrusted networks unless explicitly required and protected. Review web server, application, and reverse proxy logs for traversal payloads and unexpected file-write requests. Check the application directories, webroot, Tomcat webapps directories, upload locations, temporary directories, startup folders, scheduled tasks, and service definitions for recently created or modified suspicious files. If feasible, perform a controlled authenticated or authorized security test that attempts to write a benign marker outside the intended directory and confirm the patched system blocks it.

Typical attack path

1. Discover Samsung MagicINFO 9 Server exposed to the internet or reachable from a compromised network segment.
2. Determine or assume the server is running a vulnerable version before 21.1052.
3. Send a crafted file-write request containing directory traversal sequences such as ../, ..\, or URL-encoded equivalents.
4. Write attacker-controlled content outside the intended upload or application directory.
5. Place a web shell, script, executable, configuration file, or persistence artifact in a location executed by the application, Tomcat, or the operating system.
6. Invoke the malicious file or trigger the affected service to load it.
7. Use the resulting access to run commands, modify digital signage content, steal configuration data, establish persistence, or pivot further.

How to detect it

Investigate web server, reverse proxy, WAF, Tomcat, and MagicINFO application logs for requests containing traversal syntax, encoded traversal sequences, unusual upload destinations, or file-write operations followed by requests to newly created files. Review operating system file creation events for new JSP, WAR, script, executable, or archive files in MagicINFO, Tomcat, webroot, upload, temporary, startup, and service directories. Look for suspicious process trees where Java, Tomcat, or the MagicINFO service launches command interpreters, scripting engines, download utilities, or archive tools. Review Windows Event Logs, Sysmon, EDR telemetry, scheduled tasks, services, startup folders, and firewall logs for persistence, outbound beaconing, or command execution shortly after suspicious HTTP requests. Because this vulnerability is actively exploited in the wild, absence of a crash or visible service disruption should not be considered evidence of non-exploitation.

• ../
• ..\
• %2e%2e%2f
• %2e%2e%5c
• ..%2f
• ..%5c
• %252e%252e%252f
• %252e%252e%255c
• .jsp
• cmd.jsp
• shell.jsp
• webshell.jsp
• .war
• java.exe spawning cmd.exe
• java.exe spawning powershell.exe
• java.exe spawning sh
• tomcat spawning cmd.exe
• tomcat spawning powershell.exe
• /etc/passwd
• /windows/win.ini
• C:\Windows\System32\cmd.exe
• powershell -enc
• certutil -urlcache
• curl http
• wget http

What your security team should do

• Patch all Samsung MagicINFO 9 Server instances to version 21.1052 or later immediately, prioritizing internet-facing systems.
• Meet or exceed the CISA KEV remediation expectation associated with the 2025-06-12 due date; treat any remaining vulnerable exposure as high risk.
• Temporarily remove public access to MagicINFO servers until patching and compromise assessment are complete.
• Perform threat hunting for path traversal attempts, arbitrary file writes, newly created JSP/script files, and suspicious child processes spawned by the application or Tomcat service.
• Rotate credentials and API keys stored on or used by the server if exploitation is suspected.
• Restrict the MagicINFO service account to least privilege and remove unnecessary system-level permissions where operationally possible.
• Add compensating controls at the WAF, reverse proxy, or edge firewall to block traversal patterns and suspicious upload requests, but do not rely on these controls as a substitute for patching.
• Create SIEM alerts for encoded traversal strings, unexpected executable file creation in web-accessible directories, and command execution from Java/Tomcat-related processes.