Critical 9.8
KEV-listed
CVE-2025-4632
Exploitation of Samsung MagicINFO Flaw CVE-2025-4632 in Cryptomining Attack
Vendor / product: Samsung MagicINFO
Event date: 2025-04-30
Public PoC: Yes
First tracked by RiskWire: 2026-09-26
CISA KEV catalog
Added to KEV
Federal remediation due
2025-06-12 (471 days overdue)
Ransomware campaign use
Unknown
CISA description
Samsung MagicINFO 9 Server contains a path traversal vulnerability that allows an attacker to write arbitrary file as system authority.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Sources & citations (2)
- Attackers Build 'Silent' Cryptominer on Victim's Machine and Give Themselves Away ground.news · 2026-09-25
- Hackers Used a Samsung Flaw to Build a Cryptominer Inside Victim Systems cybersecuritynews.com · 2026-09-25
References
See CVE-2025-4632 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →