CISA Adds Samsung MagicINFO RCE and SimpleHelp Flaws to KEV — All Four Under Active Exploitation, Patch Deadline May 8

CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on April 25, ordering federal agencies to patch by May 8. All four are under active exploitation. If you run Samsung MagicINFO, SimpleHelp, or a D-Link DIR-823X, patch or replace now.

Samsung MagicINFO — CVE-2024-7399 (CVSS 8.8)

The most dangerous of the four. MagicINFO 9 Server, Samsung’s digital signage management platform, contains an improper path traversal flaw that allows unauthenticated attackers to upload arbitrary files and achieve remote code execution. No credentials required.

The attack surface is significant. MagicINFO manages digital signage at scale — hospitals, airports, retail chains, and transit systems run internet-exposed instances to push content to screens. Samsung patched this in August 2024 with version 21.1050.0, but mass exploitation started recently, 20 months after the fix shipped.

What to do: Check your MagicINFO Server version from the admin panel or via mims --version. Upgrade to 21.1050.0 or later. If the server is internet-exposed with no authentication layer in front of it, take it offline until patched.

SimpleHelp — CVE-2024-57726 + CVE-2024-57728

Two separate flaws in the SimpleHelp remote access platform that chain into a complete server takeover. CVE-2024-57726 allows a low-privilege authenticated user to escalate to administrator via a missing authorization check. CVE-2024-57728 allows an administrator — or anyone who used CVE-2024-57726 to become one — to upload arbitrary files, enabling remote code execution on the server.

SimpleHelp is widely used in managed service provider (MSP) environments. Compromise one SimpleHelp instance and you potentially have a pivot point into every client endpoint that agent touches. SimpleHelp patched both flaws in January 2025 in versions 5.3.9, 5.4.10, and 5.5.8.

What to do: Check your SimpleHelp version in the admin dashboard. Upgrade to 5.3.9, 5.4.10, or 5.5.8 depending on your branch. If you’re on a version older than those, treat this as an active compromise scenario — check your logs before upgrading.

D-Link DIR-823X — CVE-2025-29635

Command injection via the router’s web management interface on firmware version 1.0 A1. No authentication required. D-Link has not issued a patch and will not: the DIR-823X is end-of-life hardware.

What to do: Replace it. No patch is coming. If you’re managing a network with DIR-823X devices — common in small business and branch office deployments — prioritize hardware replacement over any other mitigation.

The pattern worth noticing

None of these are new CVEs. CVE-2024-7399 is 20 months old. The SimpleHelp flaws are 15 months old. They sat unnoticed by most organizations until threat actors found them. CISA’s KEV catalog is a lagging indicator, not an early warning system — when a CVE lands in it, active exploitation is already underway. The better signal is the National Vulnerability Database and vendor security advisories, watched continuously rather than reactively.

Immediate action checklist:

• MagicINFO: check version, upgrade to 21.1050.0+, audit for unauthorized file uploads in /upload directories
• SimpleHelp: check version, upgrade to patched branch, audit admin account activity since January 2025
• D-Link DIR-823X: replace hardware, no patch available — isolate from the network in the interim