Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added four vulnerabilities impacting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X series routers to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The list of vulnerabilities is below - CVE-2024-57726 (CVSS score: 9.9) - A missing authorization vulnerability in
Analysis Summary
# Vulnerability: Active Exploitation of SimpleHelp, Samsung, and D-Link Products
## CVE Details
- **CVE ID:** CVE-2024-57726, CVE-2024-57728, CVE-2024-7399, CVE-2025-29635
- **CVSS Score:** Range 7.2 to 9.9 (Critical/High)
- **CWE:** Missing Authorization (CWE-862), Path Traversal (CWE-22), Command Injection (CWE-77)
## Affected Systems
- **Products:**
- SimpleHelp (Remote Management & Monitoring)
- Samsung MagicINFO 9 Server
- D-Link DIR-823X Series Routers
- **Versions:**
- SimpleHelp: Specific versions prior to patches (not explicitly detailed in text).
- Samsung MagicINFO: Version 9.
- D-Link: DIR-823X series (End-of-Life).
- **Configurations:**
- SimpleHelp requires a low-privileged technician account for CVE-2024-57726 or admin access for CVE-2024-57728.
- D-Link vulnerability requires an "authorized" (authenticated) attacker.
## Vulnerability Description
- **CVE-2024-57726 (SimpleHelp):** Missing authorization flaw allowing low-privileged technicians to generate API keys with excessive permissions, facilitating privilege escalation to Server Admin.
- **CVE-2024-57728 (SimpleHelp):** A "Zip Slip" path traversal vulnerability. An admin can upload a crafted ZIP file to place arbitrary files anywhere on the file system, leading to Remote Code Execution (RCE).
- **CVE-2024-7399 (Samsung MagicINFO):** Path traversal flaw allowing arbitrary file writes with system-level authority.
- **CVE-2025-29635 (D-Link):** Command injection via the `/goform/set_prohibiting` endpoint, allowing arbitrary remote command execution.
## Exploitation
- **Status:** **Exploited in the wild.** All four added to CISA KEV.
- **Complexity:** Low to Medium.
- **Attack Vector:** Network.
- **PoC Availability:** Highly likely for D-Link and SimpleHelp given active botnet/ransomware usage.
## Impact
- **Confidentiality:** High (Full system access/data theft).
- **Integrity:** High (Arbitrary file write/command execution).
- **Availability:** High (Ransomware deployment/Botnet inclusion).
## Remediation
### Patches
- **SimpleHelp:** Apply latest updates from the vendor to address missing authorization and zip slip flaws.
- **Samsung:** Apply vendor-provided security patches for MagicINFO 9.
### Workarounds
- **D-Link DIR-823X:** There are no patches as these devices are End-of-Life (EoL). **Discontinue use and replace immediately.**
- **General:** Restrict access to management interfaces (SimpleHelp/MagicINFO) to trusted internal networks or via VPN only.
## Detection
- **Indicators of Compromise:**
- Presence of "DragonForce" ransomware scripts or artifacts.
- Presence of the "tuxnokill" Mirai botnet variant on D-Link devices.
- Unusual API key creation events in SimpleHelp logs.
- **Detection methods and tools:**
- Monitor for POST requests to `/goform/set_prohibiting` on D-Link hardware.
- Audit Samsung MagicINFO 9 servers for unauthorized file writes in system directories.
## References
- CISA KEV Catalog: [https://www.cisa.gov/known-exploited-vulnerabilities-catalog]
- SimpleHelp Advisory: [https://thehackernews.com/2025/02/hackers-exploit-simplehelp-rmm-flaws.html]
- Akamai Nexcorium/Mirai Report: [https://thehackernews.com/2026/04/mirai-variant-nexcorium-exploits-cve.html]
- Samsung Security Advisory: [https://thehackernews.com/2025/05/hackers-exploit-samsung-magicinfo.html]