CVE-2024-7399: Samsung MagicINFO 9 Server Unauthenticated File Write Leading to RCE

Background

Samsung MagicINFO is a commercial digital signage management platform used by retailers, hospitality organisations, transportation operators, and corporate campuses to centrally manage and schedule content on networked displays. MagicINFO 9 Server handles content scheduling, device management, and remote display configuration. A single deployment may manage thousands of networked screens across multiple physical locations.

Digital signage platforms are routinely overlooked in enterprise security programmes. Management servers are sometimes internet-exposed to facilitate remote content updates, and patch cycles on signage hardware are often irregular. Samsung PSIRT rated this vulnerability 8.8 HIGH, while NVD assessed it at 9.8 CRITICAL — a discrepancy reflecting different assessments of authentication requirements; NVD’s analysis indicates the vulnerability is exploitable without authentication.

CVE-2024-7399 was originally disclosed in August 2024 but remained unpatched in many deployments through early 2026, when CISA added it to the KEV catalogue following observed exploitation. The gap between patch availability and widespread remediation is typical of IoT and embedded management platforms, where update procedures are manual and routinely deprioritised.

Technical Mechanism

The vulnerability is rooted in a file upload handler in the MagicINFO 9 Server web application that fails to sanitise the filename parameter in multipart HTTP requests. The server accepts content uploads (images, videos, HTML templates) and writes them to a designated content directory. However, the filename validation logic does not normalise path separators or strip ../ (dot-dot-slash) sequences before using the supplied filename to construct the destination file path.

An unauthenticated attacker can craft a multipart POST request with a filename parameter containing path traversal sequences such as:

filename="../../../../../../opt/tomcat/webapps/ROOT/shell.jsp"

The server resolves this path relative to the content upload directory root, traverses up the directory tree, and writes the attacker-supplied file content to the resulting absolute path. Because the MagicINFO application server runs with system-level (root or SYSTEM) permissions to manage display hardware interfaces and system services, the written file inherits these permissions.

By writing a JSP web shell to the application server’s web root, the attacker achieves remote code execution via a subsequent HTTP request to the deployed shell. The attack chain — unauthenticated file write followed by web shell execution — is a classic CWE-22 (Path Traversal) combined with CWE-434 (Unrestricted Upload of File with Dangerous Type) exploitation pattern. No authentication, no prior access, and no user interaction is required at any stage.

Real-World Exploitation Evidence

Despite being patched in August 2024, CVE-2024-7399 entered active exploitation campaigns in early 2026 after proof-of-concept code was published. CISA’s KEV addition reflects observed exploitation against internet-facing MagicINFO installations. Shodan indexes thousands of MagicINFO server instances with management interfaces directly exposed to the internet.

Exploitation in the wild has taken several forms:

• Content hijacking: Adversaries replacing legitimate digital signage content with attacker-controlled media — particularly high-profile in retail and public transit deployments where visible content manipulation causes reputational damage
• Ransomware staging: Use of the web shell to deploy ransomware loaders, leveraging the high-privilege service account to encrypt connected storage and pivot to adjacent systems
• Cryptomining: Automated deployment of mining payloads that persist via the high-privilege service account
• Pivot to corporate network: MagicINFO servers are frequently on corporate or retail LAN segments with routing to internal infrastructure, making them valuable initial access points

Long-unpatched, internet-exposed, running as a high-privilege service account: MagicINFO ticks every box for opportunistic automated exploitation.

Impact Assessment

• Unauthenticated remote code execution as the highest-privilege service account on the server
• Content manipulation at scale: Ability to push arbitrary media content to all managed displays, with potential for disinformation, brand damage, or public safety interference
• Full server compromise: System-level access enables persistence, credential harvesting, and arbitrary system modifications
• Network pivoting: Retail and enterprise LAN access from a compromised signage server, potentially reaching point-of-sale systems, internal databases, or HR networks
• Physical facility context: In airports, hospitals, or government buildings, controlled display content represents a physical security concern
• Data exposure: Device inventory, scheduling data, and potentially credentials for connected displays and peripheral systems

Affected Versions

Remediation Steps

1. Upgrade MagicINFO 9 Server: Apply version 21.1050.0 or later from the Samsung Business portal. This release implements proper path normalisation and validation in the file upload handler.

2. Restrict internet exposure: Remove direct internet access to the MagicINFO management interface immediately. Place it behind a VPN gateway or Zero Trust Network Access solution — content scheduling does not require the management portal to be internet-facing.

3. Audit uploaded content for web shells: Inspect the MagicINFO web application directory tree for unexpected JSP, PHP, ASPX, or other executable files in the web root and content directories. Compare against a known-good file listing from a clean installation.

4. Review file write audit logs: If OS-level file auditing (Windows audit policy or Linux auditd) is enabled, review write events in the web application directories for the period since the server was last known to be clean.

5. Run as a least-privilege account: Configure the MagicINFO service to run as a dedicated service account with only the permissions required for operation, rather than as SYSTEM or root. This limits the blast radius of exploitation.

6. Implement a web application firewall: Deploy a WAF rule blocking multipart uploads containing ../, %2e%2e, or other path traversal patterns in filename fields.

Detection Guidance

Indicators of active exploitation:

• Multipart POST requests to MagicINFO upload endpoints where the Content-Disposition filename field contains .., %2e%2e, /, or \ characters
• Unexpected files with .jsp, .php, .aspx, or .war extensions appearing in web server directories outside of normal patch/update windows
• HTTP GET or POST requests to files in the web root that were not deployed as part of the MagicINFO application package
• Outbound HTTP or reverse-shell connections from the MagicINFO server process to external IP addresses
• Unexpected processes spawned by the web server process (Tomcat or IIS) such as cmd.exe, powershell.exe, bash, or nc
• Changes to display scheduling or content libraries that were not initiated through authenticated administrator sessions

Timeline

References

• NVD — CVE-2024-7399
• CISA KEV — CVE-2024-7399
• MITRE CVE — CVE-2024-7399