Latest Samsung MagicINFO Server vulnerability #
Samsung has issued a security advisory for its MagicINFO Server product, used to control intelligent signage and displays. Versions of the server prior to 21.1052 contain a path-traversal vulnerability that would allow a remote attacker to upload potentially malicious executables to a vulnerable server to arbitrary paths. Successful exploitation of this vulnerability would allow an attacker to execute arbitrary code with SYSTEM privileges. This would allow an attacker to gain complete control over the vulnerable system.
This vulnerability has been designated CVE-2025-4632 and has a CVSS score of 9.8 (critical).
Note that there is evidence that this vulnerability is being actively exploited in the wild.
What is the impact? #
Successfully exploiting this vulnerability would allow a remote attacker to execute arbitrary code on the vulnerable system with SYSTEM (that is, administrative) privileges.
Are updates or workarounds available? #
Samsung has released updates that address these issues and urges all customers to update as quickly as possible.
How to find potentially vulnerable systems with runZero #
From the Services Inventory, use the following query to locate systems running vulnerable software:
_asset.protocol:http AND protocol:http
AND (
(has:tls.subject AND tls.subject:"MagicInfo")
OR
(has:http.head.server AND http.head.server:="MagicInfo Premium Server"))
