InfoSecBulletin Cybersecurity for mankind
Hackers are exploiting an unauthenticated remote code execution vulnerability in the Samsung MagicINFO 9 Server to take control of devices and install malware.
The server allows file uploads to update display content, but hackers are using this feature to upload malicious code.
Russia detects first SuperCard malware attacks via NFC
Income Property Investments exposes 170,000+ Individuals record
ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs
CISA Flags Active Exploits in Apple iOS and TP-Link Routers
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online
Canada 2nd largest airlines “WestJet” investigates cyberattack disrupting internal systems
Paraguay 7.4 Million Citizen Records Leaked on Dark Web
High-Severity Flaw in HashiCorp Nomad Allows Privilege Escalation
SoftBank: Over 137,000 personal info leaked
Alert
Trend Micro Apex One Flaw Allow Attackers to Inject Malicious Code
The flaw identified as CVE-2024-7399 was publicly disclosed in August 2024 and fixed in version 21.1050.
The vendor describes a vulnerability in Samsung MagicINFO 9 Server as an “Improper limitation of a pathname to a restricted directory,” which allows attackers to write arbitrary files with system authority.”
On April 30, 2025, security researchers at SSD-Disclosure published detailed information and a demonstration exploit that allows remote code execution on the server without needing to log in, using a JSP web shell.
The attacker uploads a malicious .jsp file through an unauthenticated POST request, using a vulnerability to place it in a publicly accessible location.
By visiting the uploaded file, they can run commands on the operating system and view the results in the browser.
Arctic Wolf now reports that the CVE-2024-7399 flaw is being actively exploited just days after the PoC’s release, showing that attackers have started using the disclosed method in real attacks.
“Given the low barrier to exploitation and the availability of a public PoC, threat actors are likely to continue targeting this vulnerability,” warned Arctic Wolf.
Another confirmation of active exploitation comes from threat analyst Johannes Ullrich, who reported seeing a Mirai botnet malware variant using CVE-2024-7399 to take over devices.
System administrators should quickly fix CVE-2024-7399 by upgrading the Samsung MagicINFO Server to version 21.1050 or later.
