Bypass Record
Exploitation for Priv-Esc × Samsung MagicINFO
A publicly-reported instance of Exploitation for Priv-Esc bypassing Samsung MagicINFO, recorded with its original source. Factual record; no assessment of any specific deployment.
Reported as
exploitation of CVE-2025-4632, an unpatched vulnerability in Samsung MagicINFO, leading to SYSTEM-level access
Mechanism
Exploitation of CVE-2025-4632 in Samsung MagicINFO allows attackers to gain SYSTEM-level privileges on Windows endpoints. With elevated access, they install AnyDesk for remote access and persistence, and deploy a Monero miner compiled on the victim machine to evade static detection.
Detection & mitigation
Monitor for unexpected SYSTEM-level processes, especially those spawning from MagicINFO services. Detect unauthorized remote access tools like AnyDesk and anomalous CPU usage indicative of mining. Apply vendor patches promptly and restrict network exposure of MagicINFO.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.