Unauthenticated Remote Code Execution Flaw Hits Samsung MagicINFO Platform
A high-impact flaw has surfaced in Samsung’s MagicINFO platform—a widely deployed solution for managing digital signage—posing a serious threat to system security. The bug, cataloged as CVE-2024-7399, permits remote attackers to run arbitrary code with full system-level control, all without requiring login credentials. The issue carries a CVSS score of 9.8, reflecting its critical nature.
Researchers uncovered that the root of the issue is a path traversal vulnerability in a file upload endpoint. The flawed endpoint, /MagicInfo/servlet/SWUpdateFileUploader, is part of the SWUpdateFileUploadServlet class. It processes file uploads with no authentication, insufficient filename validation, and no safeguards against unsafe file extensions.
The vulnerability stems from how the server handles file paths. It appends unvalidated user input directly to a static directory path:
textString savedFileName = System.currentTimeMillis() + fileName;
swUpdateFilePath = swUpdateFileFolderPath + File.separator + savedFileName;
This naive implementation allows attackers to craft specially formed file names using path traversal sequences (../../) and upload malicious JSP files into sensitive directories. Once in place, those files can be triggered to execute server-side code—handing full control of the system to the attacker.
Samsung has issued a fix in MagicINFO 9 Server version 21.1050, modifying the input validation logic to block this attack vector. The discovery was made by an independent security researcher collaborating with SSD Secure Disclosure. Samsung was notified on January 12, 2025, and the public disclosure followed the expiration of a standard 90-day coordination window and grace period, prompted by a duplicate report.
Why it matters: MagicINFO is used globally across corporate, retail, healthcare, and public service sectors. Given its widespread adoption, the ability for unauthenticated users to seize control of signage infrastructure poses a real-world risk—not just to data, but to public communications and branding systems.
Immediate action recommended: Organizations running vulnerable versions should apply the security patch without delay, as exploitation requires no user interaction and can be executed remotely.
