CVE-2025-4632

Samsung MagicINFO 9 Server does not properly enforce restrictions on file paths provided by users, which enables directory traversal (path traversal). An attacker, without any authentication, can send a crafted network request pointing to any location in the server's file system. As a result, it is possible to write arbitrary content at any location in the file system with system account privileges (SYSTEM authority).

An attacker can write arbitrary files with system privileges, which in practice enables remote takeover of full server control — for example through uploading a webshell, overwriting configuration or binary files. It is possible to obtain full access to system resources, violate data confidentiality and integrity, and achieve persistent server takeover.

Samsung MagicINFO 9 Server must be immediately updated to version 21.1052 or newer in accordance with vendor information available at: https://security.samsungtv.com/securityUpdates#SVP-MAY-2025. Until the patch is deployed, it is recommended to restrict network access to the MagicINFO server only to trusted hosts and monitor logs for suspicious requests containing path traversal sequences.

Samsung MagicINFO 9 Server in versions prior to 21.1052

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Samsung MagicINFO 9 Server contains a path traversal vulnerability that allows an attacker to write arbitrary file as system authority.