CVE-2025-4632

Description

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.

Scoring

• CVSS: 9.8 (CRITICAL, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2025-05-22
• Remediation due date: 2025-06-12
• Known ransomware campaign use: Unknown

Weakness types (CWE)

• CWE-22
• CWE-22

References

• https://security.samsungtv.com/securityUpdates#SVP-MAY-2025
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4632

More from Samsung

• CVE-2024-7399 — MagicINFO 9 Server
• CVE-2025-21042 — Mobile Devices
• CVE-2025-21043 — Mobile Devices
• CVE-2022-22265 — Mobile Devices
• CVE-2021-25489 — Mobile Devices