# Samsung MagicINFO 9 Server digital signage flaw exploited by Mirai botnet

- Date: 2025-05-06
- Location: Global
- Type: Vulnerability
- Sector: Other
- CVE: CVE-2024-7399, CVE-2025-4632
- Products: [MagicINFO](https://signagelist.org/products/magicinfo/)

Mirai variants exploited CVE-2024-7399, a path traversal and file upload flaw in on-premise Samsung MagicINFO 9 Server, shortly after a public proof of concept appeared. Arctic Wolf and SANS reported the activity, and Huntress found version 21.1050 still vulnerable to the PoC. Help Net Security reported that a follow-on flaw, CVE-2025-4632, was the one seen in later attacks, and MagicInfo Cloud and VXT customers were not affected.

## Sources

- [Exploited: Vulnerability in software for managing Samsung digital displays (CVE-2024-7399)](https://www.helpnetsecurity.com/2025/05/06/exploited-vulnerability-software-managing-samsung-digital-displays-cve-2024-7399/) (Help Net Security)
- [Hackers exploit Samsung MagicINFO](https://thehackernews.com/2025/05/hackers-exploit-samsung-magicinfo.html) (The Hacker News)
- [Samsung MagicINFO flaw now actively exploited by Mirai botnet](https://cyberinsider.com/samsung-magicinfo-flaw-now-actively-exploited-by-mirai-botnet/) (CyberInsider)
- [Improperly Patched Samsung MagicINFO Vulnerability Exploited by Botnet](https://www.securityweek.com/improperly-patched-samsung-magicinfo-vulnerability-exploited-by-botnet/) (SecurityWeek)
- [Rapid Response: Samsung MagicINFO 9 Server Flaw](https://www.huntress.com/blog/rapid-response-samsung-magicinfo9-server-flaw) (Huntress)
- [Samsung MagicINFO vulnerability exploited after PoC publication](https://securityaffairs.com/177529/hacking/samsung-magicinfo-vulnerability-exploited-after-poc-publication.html) (Security Affairs)
- [CVE-2024-7399](https://nvd.nist.gov/vuln/detail/CVE-2024-7399) (NIST NVD)
- [https://security.samsungtv.com/securityUpdates](https://security.samsungtv.com/securityUpdates)
- [https://arcticwolf.com/resources/blog-uk/arctic-wolf-observes-exploitation-of-path-traversal-vulnerability-in-samsung-magicinfo-9-server-cve-2024-7399/](https://arcticwolf.com/resources/blog-uk/arctic-wolf-observes-exploitation-of-path-traversal-vulnerability-in-samsung-magicinfo-9-server-cve-2024-7399/)
- [CVE-2025-4632](https://nvd.nist.gov/vuln/detail/CVE-2025-4632) (NIST NVD)
- [https://security.samsungtv.com/securityUpdates#SVP-MAY-2025](https://security.samsungtv.com/securityUpdates#SVP-MAY-2025)
- [https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4632](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4632)

Page: https://signagelist.org/incidents/2025-05-samsung-magicinfo-9-server-digital-signage-flaw/