- Security researchers have seen an error in Samsung Magicinfo 9 -Server abused in nature
- It is used to implement malware
- The error was fixed in August 2024 so users had to patch now
Cyber criminals abuse a vulnerability in Samsung Magicinfo 9 server that was patched almost a year ago.
CyberSecurity researchers SSD disclosure published an in-depth analysis and a proof-of-concept (POC) of the threat to the company’s digital signage content management system (CMS).
It is used to manage, plan and monitor multimedia content across Samsung Smart screens and is a popular solution in various industries such as retail or transport.
Poc and abuse
In August 2024, Samsung announced to set a remote code company. It described it as a “incorrect limitation of a patname to a limited catalog vulnerability that allows attackers to write arbitrary files as a system authority”. It was tracked as CVE-2024-7399 and got a severity of 8.8/10 (high).
Bleeping computer Described it as an ability to upload malware through a file upload functionality designed to update display content. Samsung addressed it in version 21.1050.
Despite being determined almost a year ago, threat actors find incorrect final points to target. SSD disclosure said attackers uploading malicious .JSP files via a non-approved postal maturity.
In addition, the security company Arctic Wolf noticed how several days after POC was released, observed the error used in attack.
“Given the low barrier to the exploitation and availability of a public POC, threat actors are likely to continue to target this vulnerability,” the researchers said.
We do not know how successful these attacks are, who the threat actors are or how many organizations fell victim. We also do not know if the threat actors focus on any specific industry or whether they are just throwing a wide network.
In any case, organizations that use Samsung Magicinfo 9 server are advised to use the latest patch or at least bring their software to version 21,1050 to mitigate the risk.
Via Bleeping computer
