InfoSecBulletin Cybersecurity for mankind
Hackers are exploiting an unauthenticated remote code execution vulnerability in the Samsung MagicINFO 9 Server to take control of devices and install malware.
The server allows file uploads to update display content, but hackers are using this feature to upload malicious code.
CVE-2025-29824
Play Ransomware Exploited Windows CVE-2025-29824 as Zero-Day
Hacker exploited Samsung MagicINFO 9 Server RCE flaw
CISA adds Langflow flaw to its KEV catalog
Google Fixes Android Flaw (CVE-2025-27363) Exploited by Attackers
UAP hosted “UAP Cyber Siege 2025”, A national level cybersecurity competition
xAI Dev Leaks API Key for Private SpaceX, Tesla & Tweeter
SonicWall Exploit Chain Exposes Admin Hijack Risk via 2 CVEs
TikTok fined €530 million for sending E.U. Data to China
Microsoft New Accounts Go Passwordless By Default
SonicWall Patched for SSRF Vulnerability in SMA1000 Appliances
The flaw identified as CVE-2024-7399 was publicly disclosed in August 2024 and fixed in version 21.1050.
The vendor describes a vulnerability in Samsung MagicINFO 9 Server as an “Improper limitation of a pathname to a restricted directory,” which allows attackers to write arbitrary files with system authority.”
On April 30, 2025, security researchers at SSD-Disclosure published detailed information and a demonstration exploit that allows remote code execution on the server without needing to log in, using a JSP web shell.
The attacker uploads a malicious .jsp file through an unauthenticated POST request, using a vulnerability to place it in a publicly accessible location.
By visiting the uploaded file, they can run commands on the operating system and view the results in the browser.
Arctic Wolf now reports that the CVE-2024-7399 flaw is being actively exploited just days after the PoC’s release, showing that attackers have started using the disclosed method in real attacks.
“Given the low barrier to exploitation and the availability of a public PoC, threat actors are likely to continue targeting this vulnerability,” warned Arctic Wolf.
Another confirmation of active exploitation comes from threat analyst Johannes Ullrich, who reported seeing a Mirai botnet malware variant using CVE-2024-7399 to take over devices.
System administrators should quickly fix CVE-2024-7399 by upgrading the Samsung MagicINFO Server to version 21.1050 or later.
