Cyberattacks: Mirai botnet attacks Samsung MagicINFO 9 server
Due to ongoing attacks, admins should quickly update Samsung MagicINFO 9 Server to the latest version.
Samsung's content management system (CMS) for managing digital signage displays is the focus of attackers. Security updates have been available since August 2024.
Security researchers from Artic Wolf warn of the attacks in an article. The Internet Storm Center assumes that the attacks are being carried out via the Mirai botnet. The vulnerability (CVE-2024-7399 "high") has been known since summer 2024. At the end of April this year, security researchers from SSD Secure Disclosure published details of the vulnerability and proof-of-concept code.
Videos by heise
Patch now!
Because authentication is faulty and files are not sufficiently checked, attackers can use the vulnerability to execute malicious code without logging in. Admins should ensure that version 21.1050, which has been prepared against this, is installed. All previous versions should be vulnerable.
(des)
