Samsung has disclosed a critical vulnerability (CVE-2025-4632) in MagicINFO 9 Server, a content management system used globally for digital signage. The flaw allows unauthenticated remote attackers to write arbitrary files with SYSTEM-level privileges, potentially leading to full system compromise.
Vulnerability Details
| Identifier | Description | Severity | CVSS Score |
|---|---|---|---|
| CVE-2025-4632 | Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) | Critical | 9.8 |
Samsung Advisory ID: SVE-2025-50001
Affected Versions: MagicINFO 9 Server versions prior to 21.1052
Root Cause: Insufficient validation of file paths during write operations, enabling attackers to bypass directory restrictions and place malicious files anywhere on the system.
Potential Impact
- Arbitrary file write with SYSTEM privileges
- Remote Code Execution (RCE)
- Implantation of persistence mechanisms
- Potential firmware manipulation and network disruptions
- Complete system takeover
Exploit Prerequisites
| Access Level | Authentication Required | Attack Complexity |
|---|---|---|
| Remote | No | Low |
Related Vulnerabilities
Similar to CVE-2024-7399, a path traversal flaw disclosed in August 2024. Past patches were found insufficient, with version 21.1050 remaining vulnerable.
Mitigation & Recommendations
- Patch Immediately: Upgrade to MagicINFO 9 Server version 21.1052 or later.
- Update Path: Navigate to [Settings] → [Support] → [Software Update]. Deploy security update SVP-MAY-2025.
Temporary Workarounds (if patching delayed):
- Isolate MagicINFO systems from public networks
- Restrict network access to trusted IP ranges
- Monitor logs for suspicious file writes
Post-Patch Actions:
- Audit systems for compromise indicators
- Verify auto-update settings
- Conduct vulnerability scans and system hardening
Samsung Support Policy
Guaranteed security support for 3+ years from product launch. Critical patches extended where possible.
Conclusion
Given the CVSS score of 9.8 and the unauthenticated attack vector, this is a critical security risk. Immediate patching is strongly advised to protect enterprise environments from exploitation.
