Loading story…
Research published by SRC:INCITE describes multiple attack chains in Samsung MagicINFO 9 Server version 21.1080.0 that can lead to unauthenticated compromise, administrative account creation, and remote code execution. One chain abuses device registration and approval workflows, a URI-based license-check bypass, exposed dangerous functionality, and hard-coded credentials to provision a device-backed FTP account and upload a malicious serialized file such as Default_MO_TREE.BIN into the mofiles directory. When the Spring application restarts, MORepository deserializes the file, giving an attacker code execution; the researcher also noted that hard-coded database credentials could let an attacker directly manipulate the database and create valid FTP accounts.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
Although JSP deployment was blocked by file-type logic, the researcher showed the SQL execution primitive could be used to insert JSP as an allowed file type in the database. That restored a path to remote code execution on the server.
The follow-up post revisited SRC-2025-0003 and CVE-2025-54438-related download functionality, concluding that CifsFileDownloadServlet and especially FtpFileDownloadServlet could still be abused for arbitrary file placement. The researcher said this could also be used for authentication bypass by overwriting the server's index.html.
The researcher found that when DailyJob.checkDbValidation later processed the overwritten JSON, attacker-controlled SQL in the check_query field was executed by ServerSetupInfoImpl. This enabled database takeover actions such as creating a new administrative user.
In a follow-up analysis, the researcher described a separate chain on MagicINFO 9 Server 21.1080.0 that turned patched issues into a practical pre-authentication compromise path despite a roughly daily trigger delay. The chain combined SRC-2025-0004 in ResponseUploadActivity with path manipulation in WSServlet to overwrite PostgreSQL_checklist.json used by a scheduled validation task.
The analysis also found hard-coded database credentials that could be used to directly manipulate the database and create valid FTP accounts, creating a local privilege-escalation and attack-enablement risk. This was presented as part of the same MagicINFO 9 Server research into version 21.1080.0.
The researcher showed that unauthenticated endpoints, a URI-based license-check bypass, and in some cases a hidden orgadmin account with default password could be used to provision and approve a device-backed FTP account. An attacker could then upload a malicious serialized file such as Default_MO_TREE.BIN into the mofiles directory and gain code execution when the Spring application restarted and deserialized it.
A security researcher analyzed Samsung MagicINFO 9 Server version 21.1080.0 and found a multi-step path to remote code execution involving device registration, approval, FTP account provisioning, and unsafe Java deserialization. The issues were tracked as SRC-2025-0001 and SRC-2025-0002, alongside analysis of prior fixes for CVE-2025-54455.
Samsung addressed CVE-2025-54438, an unauthenticated directory traversal and authentication bypass flaw in the downloadChangedFiles function of MagicINFO 9 Server, after it was reported through coordinated disclosure. The issue was reported to the vendor on 2025-04-16 and later publicly disclosed as ZDI-25-655.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
srcincite.io
Open sourcesrcincite.io
Open sourcezerodayinitiative.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro Mobile Security (Enterprise) 9.8 SP5 through Critical Patch 3 contains two critical flaws, `CVE-2023-32523` and `CVE-2023-32524`, that allow unauthenticated attackers to achieve pre-authenticated remote code execution by chaining an authentication bypass with unrestricted file upload and local file inclusion weaknesses. In both cases, the application trusts a user-controlled `session_info` cookie at the `/widget` endpoint, automatically creates missing `WFUser` accounts with blank passwords, and binds them to a valid PHP session, giving attackers authenticated access without valid credentials. Attackers can then upload an arbitrary PHP file such as `PoolManager.php` into `C:\Windows\Temp` through `proxy_controller.php` and execute it via path traversal or unsanitized `require_once` input in `widget_package_manager.php` or `widgetforsecurity_package_manager.php`. The bugs are rated `CVSS 9.8`, require no authentication or user interaction, and could enable arbitrary code execution on the appliance and follow-on lateral movement. Trend Micro issued fixes on April 18, 2023, and defenders were advised to inspect `C:\Windows\Temp` for unexpected PHP files and review logs for suspicious requests hitting the vulnerable endpoints in close succession.
Jun 29, 2026
Multiple **critical, unauthenticated remote code execution and authentication-bypass vulnerabilities** in widely deployed enterprise products were reported as **actively exploited** and, in several cases, added to CISA’s **Known Exploited Vulnerabilities (KEV)** catalog. SmarterTools *SmarterMail* is being targeted in **ransomware** activity via **CVE-2026-24423**, an unauthenticated RCE caused by missing authentication on the `ConnectToHub` API (`/api/v1/settings/sysadmin/connect-to-hub`), where an attacker-controlled server can return JSON containing a `CommandMount` value that drives arbitrary command execution; the issue affects versions prior to `v100.0.9511`. Separately, SolarWinds *Web Help Desk* is affected by **CVE-2025-40551** (CVSS 9.8), a **deserialization of untrusted data** flaw in the `AjaxProxy` component enabling remote, unauthenticated command execution; CISA added it to KEV amid in-the-wild exploitation and set an accelerated patch deadline for US federal agencies. In parallel, Fortinet environments using **FortiCloud SSO** face authentication-bypass risk from **CVE-2025-59718**, **CVE-2025-59719**, and **CVE-2026-24858**, which can allow an attacker with a FortiCloud account to log into organizations’ **FortiOS, FortiManager, FortiAnalyzer, FortiProxy, and FortiWeb** if SSO is enabled; Kaspersky published **SIEM correlation rules** to detect related suspicious logins and admin actions. Samsung *MagicInfo 9 Server* (digital signage management) was also reported with a trio of severe flaws affecting versions prior to `21.1090.1`, including **CVE-2026-25202** (hardcoded credentials, CVSS 9.8) and **CVE-2026-25201** (unauthenticated arbitrary file upload leading to RCE, CVSS 8.8), creating risk of server takeover and potential network compromise; the article does not indicate KEV inclusion or confirmed exploitation for these MagicInfo issues.
Jun 29, 2026
CISA added four vulnerabilities to its **Known Exploited Vulnerabilities (KEV)** catalog after confirming active exploitation affecting **Samsung MagicINFO 9 Server**, **SimpleHelp**, and **D-Link DIR-823X** devices. The newly listed flaws are `CVE-2024-7399` in Samsung MagicINFO, `CVE-2024-57726` and `CVE-2024-57728` in SimpleHelp, and `CVE-2025-29635` in D-Link DIR-823X. The Samsung issue allows unauthenticated attackers to upload JSP files and execute code with system-level privileges, while the D-Link flaw is a command injection bug that Akamai said is being exploited by a **Mirai** botnet through crafted POST requests. The two SimpleHelp vulnerabilities are especially concerning because they can be chained from a low-privileged technician account into full server and downstream host compromise, a pattern linked to ransomware precursor activity. Under **Binding Operational Directive 22-01**, Federal Civilian Executive Branch agencies must remediate the KEV-listed flaws by **May 8, 2026**, and CISA urged broader patching and review as attackers increasingly target peripheral infrastructure such as remote support platforms, digital signage servers, and SOHO edge devices.
Jun 29, 2026