Global
Samsung MagicINFO 9 Server digital signage flaw exploited by Mirai botnet
Mirai variants exploited CVE-2024-7399, a path traversal and file upload flaw in on-premise Samsung MagicINFO 9 Server, shortly after a public proof of concept appeared. Arctic Wolf and SANS reported the activity, and Huntress found version 21.1050 still vulnerable to the PoC. Help Net Security reported that a follow-on flaw, CVE-2025-4632, was the one seen in later attacks, and MagicInfo Cloud and VXT customers were not affected.
- Type
- Vulnerability
- Sector
- Other
- Country
- Global
Products in the directory
Sources
- Exploited: Vulnerability in software for managing Samsung digital displays (CVE-2024-7399) · Help Net Security
- Hackers exploit Samsung MagicINFO · The Hacker News
- Samsung MagicINFO flaw now actively exploited by Mirai botnet · CyberInsider
- Improperly Patched Samsung MagicINFO Vulnerability Exploited by Botnet · SecurityWeek
- Rapid Response: Samsung MagicINFO 9 Server Flaw · Huntress
- Samsung MagicINFO vulnerability exploited after PoC publication · Security Affairs
- CVE-2024-7399 · NIST NVD
- https://security.samsungtv.com/securityUpdates
- https://arcticwolf.com/resources/blog-uk/arctic-wolf-observes-exploitation-of-path-traversal-vulnerability-in-samsung-magicinfo-9-server-cve-2024-7399/
- CVE-2025-4632 · NIST NVD
- https://security.samsungtv.com/securityUpdates#SVP-MAY-2025
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4632