Executive brief
Samsung MagicINFO 9 Server, a content management platform for digital signage, contains a critical security flaw that allows unauthorized individuals to write files to the server. An attacker could exploit this to gain full control over the system, potentially leading to data theft, service disruption, or the distribution of malicious content across connected displays. This vulnerability is known to be actively exploited in the wild.
Technical details
A path traversal vulnerability (CWE-22) and unrestricted file upload (CWE-434) exist in Samsung MagicINFO 9 Server versions prior to 21.1050. The flaw stems from improper limitation of pathnames to restricted directories, allowing a remote attacker to bypass directory restrictions. By sending a specially crafted request, an unauthenticated attacker can write arbitrary files to the underlying operating system with system-level privileges. This can lead to remote code execution (RCE) and full system compromise. The vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog.
Affected products
- Samsung MagicINFO 9 Server before 21.1050
CVE identifiers
- CVE-2024-7399
- CVE-2024-57728
- CVE-2025-29635
- CVE-2024-57726
Timeline
- 2024-08-12: disclosed: Initial NVD publication
- 2026-04-24: kev added: Added to CISA KEV catalog due to active exploitation
- 2026-04-24: advisory: Updated advisory with exploitation details