InfoSecBulletin Cybersecurity for mankind
Hackers are exploiting an unauthenticated remote code execution vulnerability in the Samsung MagicINFO 9 Server to take control of devices and install malware.
The server allows file uploads to update display content, but hackers are using this feature to upload malicious code.
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
The flaw identified as CVE-2024-7399 was publicly disclosed in August 2024 and fixed in version 21.1050.
The vendor describes a vulnerability in Samsung MagicINFO 9 Server as an “Improper limitation of a pathname to a restricted directory,” which allows attackers to write arbitrary files with system authority.”
On April 30, 2025, security researchers at SSD-Disclosure published detailed information and a demonstration exploit that allows remote code execution on the server without needing to log in, using a JSP web shell.
The attacker uploads a malicious .jsp file through an unauthenticated POST request, using a vulnerability to place it in a publicly accessible location.
By visiting the uploaded file, they can run commands on the operating system and view the results in the browser.
Arctic Wolf now reports that the CVE-2024-7399 flaw is being actively exploited just days after the PoC’s release, showing that attackers have started using the disclosed method in real attacks.
“Given the low barrier to exploitation and the availability of a public PoC, threat actors are likely to continue targeting this vulnerability,” warned Arctic Wolf.
Another confirmation of active exploitation comes from threat analyst Johannes Ullrich, who reported seeing a Mirai botnet malware variant using CVE-2024-7399 to take over devices.
System administrators should quickly fix CVE-2024-7399 by upgrading the Samsung MagicINFO Server to version 21.1050 or later.
