CVE-2025-4632Vulnerability
Samsung MagicINFO 9 Server Path Traversal Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 2 independent sources · first reported by Huntress · last reported
Last reported 23 days ago
CISA KEVAdded 22 May 2025
Fix due 12 Jun 2025
Used by ransomware: not knownCISA KEV catalogue
Fix due 12 Jun 2025
Used by ransomware: not knownCISA KEV catalogue
EPSS24.1%
higher than 97% of CVEsFIRST EPSS, as of 23 Oct 2026
higher than 97% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
2 reports, newest first · the exact sentence from each-
ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories“"The incident started with exploitation of a known Samsung MagicINFO flaw [CVE-2025-4632]," Huntress said.”
-
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint“In this incident, the activity was reportedly associated with CVE-2025-4632, a Samsung MagicINFO vulnerability enabling attackers to write an arbitrary file as system authority.”
Indicators reported together
named in the same reports- hxxp://194.87.89[.]30:8899/anydesk.exein 1 report
- 194.87.89[.]30in 1 report
- auto.c3pool[.]orgin 1 report
- 0d202e16408770e8…060315b30dd1in 1 report
Copy these 4 indicators · defanged
Also named with it: CVE-2024-7399, CVE-2026-102489, CVE-2026-102490
Thanks — we review every report.