CISA Adds Four Actively Exploited Vulnerabilities to KEV, Sets May 8 Deadline
Summary
CISA added four actively exploited flaws affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers to KEV. Federal agencies should apply fixes or retire affected routers by May 8, 2026.
Key points
- CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation.
- CVE-2024-57726 lets low-privileged SimpleHelp technicians create overly privileged API keys that can enable server-admin escalation.
- CVE-2024-57728 and CVE-2024-7399 are path traversal flaws that can write arbitrary files; the article says they may enable code execution or system-level file writes.
- CVE-2025-29635 is a command injection flaw in end-of-life D-Link DIR-823X routers, exploitable through a POST request to /goform/set_prohibiting.
- Earlier reporting linked exploitation of the SimpleHelp flaws to ransomware activity, including a campaign attributed to DragonForce; the article notes CISA lists ransomware use as unknown.
- MagicINFO exploitation has previously been linked to Mirai activity; Akamai reported attempts against D-Link devices to deliver a Mirai variant called tuxnokill.
- Federal agencies are advised to apply fixes or, for the end-of-life D-Link routers, discontinue use by May 8, 2026.
Article Details
- Vulnerability Types
- Missing authorization
- Path traversal
- Command injection
- Severity
- CVSS scores range from 7.2 to 9.9.
- Affected Versions
- Samsung MagicINFO 9 Server
- D-Link DIR-823X series routers
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Discontinue use of affected D-Link DIR-823X appliances.
CVE
CVE-2024-57726Simple-help · SimplehelpCVE-2024-57726 allows low-privileged technicians to create API keys that can escalate to server admin.CVE-2024-57728Simple-help · SimplehelpCVE-2024-57728 and CVE-2024-7399 are path traversal flaws that can write arbitrary files and enable code execution.CVE-2024-7399Samsung Electronics · MagicINFO 9 ServerCVE-2024-57728 and CVE-2024-7399 are path traversal flaws that can write arbitrary files and enable code execution.CVE-2025-29635Dlink · Dir-823x firmwareCVE-2025-29635 is a command injection in D-Link DIR-823X routers exploitable via a POST request to /goform/set_prohibiting.
Threat Actors
Malware
Miraiand a command injection in end-of-life D-Link routers tied to DragonForce ransomware activity and Mirai botnet campaigns; agencies are advised to apply fixes or retire affected appliances by May 8, 2026.tuxnokillAs for CVE-2025-29635, Akamai disclosed earlier this week that it recorded attempts against D-Link devices to deliver a Mirai botnet variant named “tuxnokill.”
Vendors
D-LinkCISA added four actively exploited vulnerabilities affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers to its Known Exploited Vulnerabilities catalog.SamsungCISA added four actively exploited vulnerabilities affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers to its Known Exploited Vulnerabilities catalog.SimpleHelpCISA added four actively exploited vulnerabilities affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers to its Known Exploited Vulnerabilities catalog.
Products
D-Link DIR-823XCISA added four actively exploited vulnerabilities affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers to its Known Exploited Vulnerabilities catalog.Samsung MagicINFO 9 ServerCISA added four actively exploited vulnerabilities affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers to its Known Exploited Vulnerabilities catalog.SimpleHelpCISA added four actively exploited vulnerabilities affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers to its Known Exploited Vulnerabilities catalog.