May 22, 2025 Global

Samsung MagicINFO 9 Server patch bypass CVE-2025-4632 exploited, sometimes for Mirai

CVE-2025-4632 is a path traversal flaw in MagicINFO 9 Server that bypassed the August 2024 fix for CVE-2024-7399 and lets attackers write arbitrary files with SYSTEM authority. Attackers began exploiting it shortly after a public proof of concept appeared on April 30, 2025, in some cases to deploy the Mirai botnet. CISA added it to the KEV catalog on May 22, 2025, and Samsung fixed it in version 21.1052.

Type: Vulnerability
Sector: Other
Country: Global
CVE: CVE-2025-4632 CVE-2024-7399

Products in the directory

MagicINFO

Sources

CVE-2025-4632 · NIST NVD
Samsung Patches CVE-2025-4632 Used to Deploy Mirai Botnet via MagicINFO 9 Exploit · The Hacker News
Samsung MagicINFO flaw now actively exploited by Mirai botnet · CyberInsider