CVE-2025-4632: listed in the CISA KEV catalog CVE-2025-4632 · CVSS 9.8 CRITICAL · EPSS 24% · KEV 2025-05-22
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.
Is CVE-2025-4632 exploited? Listed in the CISA KEV catalog on 2025-05-22. Federal remediation due 2025-06-12. Past that date by 476 days. EPSS puts exploitation in the next 30 days at 24%. Public exploit code: none found in monitored sources. Public detection rules exist. Which products and versions are affected? Samsung Electronics · MagicINFO 9 Server · >= 0, < 21.1052 Is there a patch? No patch identifier recorded here yet.
What PlainSec published about CVE-2025-4632 PlainSec has not published a story about this CVE.
Primary sources What this record does not say KEV and EPSS are re-checked daily. Record last updated 2026-09-25.
CVE-2025-4632: listed in the CISA KEV catalog CVE-2025-4632 · CVSS 9.8 CRITICAL · EPSS 24% · KEV 2025-05-22
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.
Is CVE-2025-4632 exploited? Listed in the CISA KEV catalog on 2025-05-22. Federal remediation due 2025-06-12. Past that date by 476 days. EPSS puts exploitation in the next 30 days at 24%. Public exploit code: none found in monitored sources. Public detection rules exist. Which products and versions are affected? Samsung Electronics · MagicINFO 9 Server · >= 0, < 21.1052 Is there a patch? No patch identifier recorded here yet.
What PlainSec published about CVE-2025-4632 PlainSec has not published a story about this CVE.
Primary sources What this record does not say KEV and EPSS are re-checked daily. Record last updated 2026-09-25.