InfoSecBulletin Cybersecurity for mankind
Hackers are exploiting an unauthenticated remote code execution vulnerability in the Samsung MagicINFO 9 Server to take control of devices and install malware.
The server allows file uploads to update display content, but hackers are using this feature to upload malicious code.
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
The flaw identified as CVE-2024-7399 was publicly disclosed in August 2024 and fixed in version 21.1050.
The vendor describes a vulnerability in Samsung MagicINFO 9 Server as an “Improper limitation of a pathname to a restricted directory,” which allows attackers to write arbitrary files with system authority.”
On April 30, 2025, security researchers at SSD-Disclosure published detailed information and a demonstration exploit that allows remote code execution on the server without needing to log in, using a JSP web shell.
The attacker uploads a malicious .jsp file through an unauthenticated POST request, using a vulnerability to place it in a publicly accessible location.
By visiting the uploaded file, they can run commands on the operating system and view the results in the browser.
Arctic Wolf now reports that the CVE-2024-7399 flaw is being actively exploited just days after the PoC’s release, showing that attackers have started using the disclosed method in real attacks.
“Given the low barrier to exploitation and the availability of a public PoC, threat actors are likely to continue targeting this vulnerability,” warned Arctic Wolf.
Another confirmation of active exploitation comes from threat analyst Johannes Ullrich, who reported seeing a Mirai botnet malware variant using CVE-2024-7399 to take over devices.
System administrators should quickly fix CVE-2024-7399 by upgrading the Samsung MagicINFO Server to version 21.1050 or later.
