CVE-2024-7399: Critical Samsung MagicINFO Server RCE Flaw Exploited

A security flaw in Samsung’s MagicINFO 9 Server is now being actively used by hackers to hijack systems and install malware. The vulnerability, identified as CVE-2024-7399, allows attackers to execute code on a targeted server without needing any login credentials.

What is Samsung MagicINFO Server?

Samsung MagicINFO Server is a content management system (CMS) developed by Samsung to manage and control digital signage. These are the electronic displays commonly seen in retail stores, airports, hospitals, restaurants, and corporate buildings. MagicINFO helps users schedule, distribute, display, and monitor multimedia content across multiple screens remotely.

With the rise of smart displays in commercial spaces, MagicINFO has become a widely adopted solution for businesses that rely on digital communication. However, its popularity also makes it an attractive target for hackers.

CVE-2024-7399

The security vulnerability lies in the file upload feature of the MagicINFO server. This feature is normally used to update content on digital displays. Unfortunately, hackers have discovered a way to exploit it to upload malicious files instead.

Samsung officially disclosed the flaw in August 2024 and fixed it in version 21.1050 of the software. The issue was described as an “improper limitation of a pathname to a restricted directory,” which means that attackers can trick the system into writing files where it shouldn’t—essentially gaining unauthorized system-level access.

How the Exploit Works

On April 30, 2025, cybersecurity experts at SSD-Disclosure published a technical breakdown of how this vulnerability can be exploited. They also released a proof-of-concept (PoC), making it easier for attackers to reproduce the attack.

Here’s how the exploit works:

• The attacker sends an unauthenticated POST request to the MagicINFO server, uploading a malicious .jsp (Java Server Pages) file.

• Due to a path traversal flaw, the attacker places this file in a publicly accessible web directory.

• By visiting this file through a browser and adding a command parameter (cmd), the attacker can run any command on the system and see the result directly in their browser.

This means the attacker can take full control of the server, install malware, steal data, or use the compromised server to attack other systems.

Active Attacks Confirmed

Just days after the PoC was made public, cybersecurity firm Arctic Wolf reported seeing active attacks in the wild using this exact method. According to their report, hackers have already started exploiting the vulnerability to compromise real systems.

“Given the low barrier to exploitation and the availability of a public PoC, threat actors are likely to continue targeting this vulnerability,” said Arctic Wolf in a warning to system administrators.

Additional confirmation of real-world attacks came from Johannes Ullrich, a well-known threat analyst. He observed that a Mirai botnet variant was using this vulnerability to spread malware and take over connected devices. Mirai is a type of malware that turns networked devices into remotely controlled “bots” used in large-scale attacks like Distributed Denial of Service (DDoS).