Summary

Hackers are now actively exploiting an unauthenticated remote code execution (RCE) vulnerability in the Samsung MagicINFO 9 Server to hijack devices and deploy malicious software.

This widespread vulnerability poses a serious threat to businesses and organizations using the affected servers.

The Vulnerability

The vulnerability, identified as CVE-2020-11400, allows an unauthenticated attacker to execute arbitrary code on a server running the MagicINFO software via an insecure deserialization flaw in its API.

In this scenario, an attacker could, without requiring user interaction, gain complete control of the affected server.

Product Usage

Samsung MagicINFO software is a comprehensive platform for digital signage, providing seamless remote hardware and software management for digital displays located anywhere.

The exploitation of this server could allow an attacker to manipulate anything from corporate presentations to public-facing digital billboards.

The Exploitation

Active exploits in the wild have been detected, likely aiming to compromise the affected servers for use in distributed denial of service (DDoS) attacks, spread ransomware, steal sensitive data, or use the servers as pivot points for further internal network exploitation.

In a highly connected corporate system, this could lead to widespread disruption and significant business impact.

Remediation Measures

Samsung has released a patch to address this vulnerability as part of the MagicINFO version 9.1 patch 1 released on April 20, 2020.

It’s strongly recommended for administrators to apply this critical update as soon as possible and ensure all installations are running the latest patches and updates.

For servers unreachable for updates or patches, isolation is advised to mitigate any potential exploitation.

Detection and Security Best Practices

In addition to patching, businesses should enforce a strong cybersecurity hygiene regimen.

This includes monitoring network traffic for irregularities, running periodic vulnerability scans, applying a principle of least privilege to all systems and services, and regularly training end-users about potential phishing attempts and suspicious email attachments that can compromise the system.