CVE-2025-4632

Name of the Vulnerable Software and Affected Versions Samsung MagicINFO 9 Server versions prior to 21.1052

Description Samsung MagicINFO 9 Server contains a path traversal issue caused by improper limitation of a pathname to a restricted directory. This flaw allows a remote attacker to write arbitrary files to the system with system-level authority. The issue has been exploited in the wild to achieve remote code execution without authentication, facilitating the deployment of Monero cryptocurrency miners (such as XMRig), the Mirai Botnet, and remote management tools like AnyDesk. In observed incidents, attackers used the tomcat9.exe process as a pivot point to spawn cmd.exe or PowerShell, create unauthorized local administrator accounts, and disable security software to maintain persistence and stealth.

Recommendations Update Samsung MagicINFO 9 Server to version 21.1052 or later.