Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server…

#Requires -RunAsAdministrator
<#
  Check-CVE-2025-4632.ps1
  Checks whether the local Samsung MagicINFO 9 Server installation
  is vulnerable to CVE-2025-4632 (path traversal → RCE).
  Fixed version: 21.1052.0
  Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'
$fixedVersion = [version]'21.1052.0'

# Registry paths where MagicINFO stores version info
$regPaths = @(
    'HKLM:\SOFTWARE\Samsung\MagicInfo-i\Server\Premium',
    'HKLM:\SOFTWARE\Samsung\MagicInfo\Server',
    'HKLM:\SOFTWARE\WOW6432Node\Samsung\MagicInfo-i\Server\Premium'
)

$installedVersion = $null

foreach ($rp in $regPaths) {
    if (Test-Path $rp) {
        try {
            $props = Get-ItemProperty -Path $rp -ErrorAction SilentlyContinue
            $verString = $props.Version
            if (-not $verString) { $verString = $props.ProductVersion }
            if (-not $verString) { $verString = $props.DisplayVersion }
            if ($verString) {
                # Normalize: strip any leading 'v' or trailing text
                $verString = ($verString -replace '[^0-9.]', '').Trim('.')
                $installedVersion = [version]$verString
                Write-Host "[*] Found MagicINFO at registry key: $rp"
                Write-Host "[*] Installed version: $installedVersion"
                break
            }
        } catch {
            continue
        }
    }
}

# Fallback: check Uninstall keys
if (-not $installedVersion) {
    $uninstallPaths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )
    foreach ($up in $uninstallPaths) {
        $entries = Get-ItemProperty -Path $up -ErrorAction SilentlyContinue |
            Where-Object { $_.DisplayName -like '*MagicINFO*' -or $_.DisplayName -like '*MagicInfo*' }
        if ($entries) {
            $entry = $entries | Select-Object -First 1
            $verString = $entry.DisplayVersion
            if ($verString) {
                $verString = ($verString -replace '[^0-9.]', '').Trim('.')
                $installedVersion = [version]$verString
                Write-Host "[*] Found MagicINFO via Uninstall key"
                Write-Host "[*] Installed version: $installedVersion"
                break
            }
        }
    }
}

# Also check for the Tomcat service as a secondary indicator
$tomcatService = Get-Service -Name '*MagicInfo*' -ErrorAction SilentlyContinue

if (-not $installedVersion) {
    if ($tomcatService) {
        Write-Host "[!] MagicINFO service detected but version could not be determined."
        Write-Host "UNKNOWN"
        exit 2
    } else {
        Write-Host "[*] Samsung MagicINFO 9 Server does not appear to be installed on this host."
        Write-Host "UNKNOWN"
        exit 2
    }
}

if ($installedVersion -lt $fixedVersion) {
    Write-Host "`n[!!!] CVE-2025-4632: VULNERABLE"
    Write-Host "Installed version $installedVersion is below the fixed version $fixedVersion."
    Write-Host "Immediate patching required — this CVE is actively exploited (KEV-listed)."
    Write-Host "VULNERABLE"
    exit 1
} else {
    Write-Host "`n[+] CVE-2025-4632: PATCHED"
    Write-Host "Installed version $installedVersion meets or exceeds the fixed version $fixedVersion."
    Write-Host "PATCHED"
    exit 0
}