CVE-2025-4632: Samsung MagicINFO 9 Server - File Upload & Remote Code Execution
HoneyLabs honeypots recorded 6 probes matching CVE-2025-4632 from 1 distinct source IP address in the last 7 days. Severity is rated critical.
This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2025-05-22.
Request paths that identify it
- /MagicInfo/servlet/SWUpdateFileUploader?fileName=./../../../../../../server/{{*}}.html&deviceType={{*}}&deviceModelName=…
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 93.123.109.214 | 6 | Techoff Srv Limited | Bulgaria |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS48090 | Techoff Srv Limited | 6 | 1 |
Where it comes from
| Country | Probes |
|---|---|
| Bulgaria | 6 |
Captured requests
- /MagicInfo/servlet/SWUpdateFileUploader?fileName=./../../../../../../server/anbEMS.html&deviceType=WoOUXe&deviceModelName=KiwKBi&swVer=515
- /MagicInfo/servlet/SWUpdateFileUploader?fileName=./../../../../../../server/edDoip.html&deviceType=WbcgdE&deviceModelName=eqSiEz&swVer=784
- /MagicInfo/servlet/SWUpdateFileUploader?fileName=./../../../../../../server/ZFteRO.html&deviceType=NPaBXu&deviceModelName=Zgmlkn&swVer=860
- /MagicInfo/servlet/SWUpdateFileUploader?fileName=./../../../../../../server/rRtqjA.html&deviceType=mkuQXm&deviceModelName=fjJXGK&swVer=185
HTTP client fingerprints
- b11cuq060_00050813_95cc9d02
CVE report
CVE report
Open a specific CVE from the CVE tracker.