A digital-signage content management system is on the US government's list of software that attackers are actively using. On 24 April 2026 CISA added CVE-2024-7399, a path-traversal flaw in Samsung MagicINFO 9 Server, to its Known Exploited Vulnerabilities catalogue, with a remediation deadline of 8 May 2026 for US federal civilian agencies. The vendor had fixed the flaw in 2024. The exploitation being tracked in 2026 is of servers that never applied it.
What CISA listed, and when
The dates are the argument, so they are worth laying out in order. The CVE record was published on 12 August 2024 and describes an improper limitation of a pathname in Samsung MagicINFO 9 Server versions before 21.1050 that "allows attackers to write arbitrary file as system authority". NVD scores it 9.8 critical; Samsung's own product security team scored the same flaw 8.8 high. That should have been the end of the vulnerability's life.
It did not end there. A public proof of concept appeared in late April 2025, and Arctic Wolf observed exploitation in the wild in early May 2025. It then got worse in an instructive way: Huntress independently verified that versions 21.1050.0 and 21.1040.2 — including the build recommended as the fix — remained vulnerable to the publicly reported exploit. That gap became a second CVE. CVE-2025-4632, published 13 May 2025 and scored 9.8 critical, covers MagicINFO 9 Server versions before 21.1052, and Censys states plainly that the exploit "remained effective even on systems patched against CVE-2024-7399", meaning CVE-2025-4632 bypasses the earlier fix. CISA added that one to the catalogue on 22 May 2025. Nearly a year later, the original 2024 entry joined it, because servers were still being taken over through it. Public reporting has linked exploitation of CVE-2024-7399 to activity deploying the Mirai botnet, which is a denial-of-service business, not a defacement one — the screens keep working while the server does someone else's work. The trade press covered the listing as a warning to the whole sector, which is the right reading.
Be fair about who did what. Samsung published a CVE, shipped a fix, shipped a second fix when the first proved incomplete, and documented both. The machines being recruited into a botnet in 2026 are running software whose patch has been available since 2024. This is not a story about a vendor's security posture. It is a story about what happens to a server-based CMS that nobody owns.
Why a server-based CMS accumulates this exposure
Three properties combine here, and any signage estate built on a management server has all three regardless of whose logo is on it.
It is reachable. A management console is put on a public IP so the branch managers, the agency and the person on leave can reach it. In its May 2025 advisory Censys reported observing 1,101 exposed Samsung MagicINFO servers online, and of the 116 whose version could be enumerated, half were running a vulnerable build. Nobody deliberately publishes a file-write primitive to the internet; they publish a login page, and the flaw comes with it.
It runs on a general-purpose OS. A Java web application on a Windows server inherits the whole stack: the application server, the runtime, the operating system, each with its own advisory feed and its own maintenance window. "Write an arbitrary file as system authority" is only interesting because there is a system authority to write as, and a web-application directory where a written file becomes executable code. The threat model for signage networks is not the screen. It is the machine that can talk to every screen and also sits on your corporate VLAN.
Nobody's patch calendar covers it. Signage is bought by marketing, facilities or operations, and is commissioned by an integrator who leaves. It rarely appears in the asset register that drives patching, which is exactly how a fix released in August 2024 is still missing from internet-facing servers twenty months later. We have written about the mechanics of this before in the 700 MB patch problem and about where the industry benchmark has moved in security update cycles are dead. The KEV listing is the same failure with a federal deadline attached.
Credentials are the fourth item on the list and the one that survives patching. Shared administrator logins, integrator accounts that were never revoked, and passwords that predate the current IT team are the ordinary route into a signage console, and a file-write vulnerability just removes the need for them.
What to check this week
Six steps, in order, and the first three can be done in an afternoon.
- Inventory what is exposed. Scan your own external ranges for signage management consoles. Not "do we think it is behind the firewall" — a scan, with a result.
- Read the build number. For MagicINFO 9 Server, the comparison is 21.1052 or later. A change log saying the server was patched is not the same fact, as the 21.1050 case shows.
- Patch, or remove the internet path today. If the maintenance window is weeks away, put the console behind a VPN or an allow-listed jump host in the meantime and give that mitigation an owner and an end date.
- Rotate credentials. Every administrator account on the CMS, every integrator account, every service account the CMS uses to reach players or file shares. Assume disclosure if the server was exposed and unpatched at any point.
- Look for what a web shell leaves behind. Unexpected JavaServer Pages files in upload directories, new administrator accounts, new services or scheduled tasks, and sustained outbound traffic that does not match content distribution. If you find any of it, switch to the incident response playbook rather than continuing to patch.
- Segment. The signage VLAN should not reach finance, and the CMS should not be able to open arbitrary outbound connections. Our network segmentation and zero-trust guide covers the firewall rules and the 802.1X posture that make a compromised player or console a contained event.
What to write into the next tender
The interesting question for anyone specifying an estate now is which clause would have prevented this. Four, and they cost nothing at the drafting stage.
- A patch SLA with numbers in it. Critical fixes applied within a stated number of days of vendor release, and a shorter, separate clock for any CVE that appears in the CISA KEV catalogue. The federal deadline on CVE-2024-7399 was fourteen days; that is a defensible benchmark to borrow.
- An exposure policy. No management server on a public IP without a named compensating control and a named owner, with a documented exception process. Write it down and the default stops being "publish it, it's easier".
- Vendor CVE history disclosure. Ask every bidder for every CVE affecting the proposed product in the last thirty-six months, with publication date, fixed version and whether it reached the KEV catalogue. A vendor with a clean answer will give it gladly; a vendor who cannot produce the list has answered a different and more useful question.
- The update mechanism itself. Signed firmware, hardware verification before installation, and a rollback path, so that applying a fix quickly is never a fleet-wide risk in its own right. The mechanics are in our secure update strategy.
Where SpinetiX sits, and where it does not
The architectural answer to a vulnerable management server is to have less of one. SpinetiX DSOS is a purpose-built signage operating system built on Yocto Linux and stripped to the bare minimum: no app store, no general-purpose browser stack, no shell, no user-controlled processes. It carries a zero published-CVE record since 2007, and a 2024 NCC Group audit commissioned by SpinetiX found no critical vulnerabilities. The invidis Yearbook 2026 reached the same conclusion from the outside, describing DSOS as a hardened OS "all but immune to security vulnerabilities" — we unpacked that assessment in what the invidis Yearbook says about DSOS.
The honest boundary matters more than the claim. A SpinetiX estate still contains general-purpose software, and pretending otherwise would be the same mistake in a different colour. Elementi is a Windows desktop application, which means the authoring workstation is a Windows machine on your network, patched on your schedule. ARYA is a vendor-operated cloud CMS, which substitutes SpinetiX's patch discipline for your own rather than eliminating the question. Player administrator passwords, network segmentation and whether any management interface is published to the internet stay with the operator no matter what the player runs. What the architecture removes is the class of problem in this article: an internet-reachable general-purpose server whose compromise hands an attacker system authority and a route onward.
The lesson of the KEV listing is not that one vendor's software had a flaw. Every vendor's software has flaws, and this one was found, fixed and documented on schedule. The lesson is that a signage estate is an IT asset with an IT patch obligation, and that the fastest way to shrink that obligation is to have fewer general-purpose machines carrying it. If you are auditing an estate or writing the clauses for the next one, talk to Media La Vista or read our security and governance overview.