Huntress Confirms Unpatched Samsung MagicINFO 9 Flaw Affects Latest Version
Summary
Huntress verified that MagicINFO 9 Server versions 21.1050.0 and 21.1040.2 remain vulnerable to unauthenticated web-shell upload and remote code execution. Exploitation, including by Mirai, has been observed; no fix was available.
Key points
- Huntress independently verified that MagicINFO 9 Server versions 21.1050.0 and 21.1040.2 are vulnerable despite reports that the latest version was fixed.
- The vulnerability chain allows an unauthenticated user to upload a web shell and execute code as the Apache Tomcat process.
- Huntress observed exploitation of systems running the latest available version; a Mirai botnet variant is also reported to be exploiting the flaw.
- The article says no patch was available at publication. Huntress notified Samsung and had not received a response.
- Huntress advises keeping MagicINFO 9 Server off the internet until a proper update is released and applied.
Article Details
- Vulnerability Types
- Unauthenticated file upload leading to web shell deployment and remote code execution
- Severity
- High
- Affected Versions
- MagicINFO 9 Server 21.1050.0
- MagicINFO 9 Server 21.1040.2
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- unavailable
- Workarounds
- Ensure MagicINFO 9 Server is not internet-facing until a proper update is released and applied.