A critical security vulnerability has been discovered in Samsung’s MagicINFO digital signage management platform that could allow attackers to execute arbitrary code with system-level privileges without requiring authentication. Security researchers have identified a path traversal vulnerability that enables attackers to write arbitrary files to the system. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The vulnerability, tracked as CVE-2024-7399, affects Samsung MagicINFO 9 Server versions prior to 21.1050 and has received a CVSS score of 9.8, indicating maximum severity. Samsung MagicINFO is widely used for digital signage management across various industries, making this vulnerability particularly concerning for organizations that rely on this platform for their display systems. When combined, these vulnerabilities allow attackers to upload malicious JSP files and execute arbitrary server-side code with system privileges. This implementation enables attackers to upload web shells or other malicious code that can be executed with server privileges, potentially leading to complete system compromise. Samsung has acknowledged the vulnerability and released a patch in version 21.1050 of the MagicINFO 9 Server.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 30 Apr 2025 10:15:06 +0000