InfoSecBulletin Cybersecurity for mankind
Hackers are exploiting an unauthenticated remote code execution vulnerability in the Samsung MagicINFO 9 Server to take control of devices and install malware.
The server allows file uploads to update display content, but hackers are using this feature to upload malicious code.
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
The flaw identified as CVE-2024-7399 was publicly disclosed in August 2024 and fixed in version 21.1050.
The vendor describes a vulnerability in Samsung MagicINFO 9 Server as an “Improper limitation of a pathname to a restricted directory,” which allows attackers to write arbitrary files with system authority.”
On April 30, 2025, security researchers at SSD-Disclosure published detailed information and a demonstration exploit that allows remote code execution on the server without needing to log in, using a JSP web shell.
The attacker uploads a malicious .jsp file through an unauthenticated POST request, using a vulnerability to place it in a publicly accessible location.
By visiting the uploaded file, they can run commands on the operating system and view the results in the browser.
Arctic Wolf now reports that the CVE-2024-7399 flaw is being actively exploited just days after the PoC’s release, showing that attackers have started using the disclosed method in real attacks.
“Given the low barrier to exploitation and the availability of a public PoC, threat actors are likely to continue targeting this vulnerability,” warned Arctic Wolf.
Another confirmation of active exploitation comes from threat analyst Johannes Ullrich, who reported seeing a Mirai botnet malware variant using CVE-2024-7399 to take over devices.
System administrators should quickly fix CVE-2024-7399 by upgrading the Samsung MagicINFO Server to version 21.1050 or later.
