Under Active Fire: CISA Warns of New Exploits in Samsung, SimpleHelp, and D-Link Hardware

The United States Cybersecurity and Infrastructure Security Agency (CISA) has once again augmented its repository of vulnerabilities identified in active, real-world incursions. The latest revision incorporates four distinct flaws within products from Samsung, SimpleHelp, and D-Link. These vulnerabilities represent a heightened threat, as they offer adversaries not merely a theoretical vector for exploitation, but a validated and proven path to systemic compromise.

CISA has integrated CVE-2024-7399, CVE-2024-57726, CVE-2024-57728, and CVE-2025-29635 into its Known Exploited Vulnerabilities (KEV) catalog. This catalog serves as a critical resource for administrators, highlighting flaws with empirical evidence of exploitation to facilitate the prioritization of remediation efforts.

CVE-2024-7399 plagues Samsung MagicINFO 9 Server (prior to version 21.1050). A path traversal error enables an authenticated adversary to write arbitrary files with elevated system privileges. In practical application, this flaw allows for remote code execution (RCE) on the host server managing the MagicINFO environment.

Two further vulnerabilities concern SimpleHelp, a utility for remote support and device management:

• CVE-2024-57726 permits a technician with minimal privileges to generate access keys with excessive permissions, subsequently escalating their authority to that of a server administrator.

• CVE-2024-57728 affects SimpleHelp version 5.5.7 and its predecessors. An administrator can upload a meticulously crafted archive to write files outside of the designated directory. This flaw, commonly referred to as a “Zip Slip” vulnerability, facilitates arbitrary code execution under the security context of the SimpleHelp server process.

CVE-2025-29635 was identified in D-Link DIR-823X routers (firmware versions 240126 and 240802). This command injection vulnerability allows an authenticated attacker to dispatch a specialized request to the /goform/set_prohibiting endpoint to execute remote commands. Public security advisories have already linked this flaw to incursions targeting legacy D-Link hardware and active recruitment into the Mirai botnet.

The KEV catalog was established under the auspices of Directive BOD 22-01, which mandates that U.S. federal civilian agencies remediate such vulnerabilities within strict timeframes to fortify government networks against active threats. Although these requirements formally apply only to federal entities, CISA strongly encourages all organizations to utilize the catalog as a benchmark for urgent remediation.

This update underscores a persistent trend: adversaries are relentlessly pursuing not only large-scale enterprise architectures but also remote support utilities, management servers, and network peripherals. Given that these products often possess privileged access to critical network segments, any delay in patching can swiftly transform a singular vulnerability into a comprehensive infrastructural breach.