A critical path traversal vulnerability in Samsung MagicINFO 9 Server is under active exploitation to deploy webshells and botnet malware.

The flaw resides in the SWUpdateFileUploader servlet, where improper path limitation (CWE-22) and unrestricted file upload (CWE-434) allow unauthenticated attackers to write arbitrary files to the host system with SYSTEM authority.

Successful exploitation allows an attacker to achieve full remote code execution on the server hosting MagicINFO 9. This compromise can lead to complete data exfiltration, total system takeover, and the deployment of malicious payloads such as webshells or botnet agents. With a CVSS score of 9.5, this represents a major threat to organizational infrastructure.

Immediate Action: Update the MagicINFO 9 Server to version 21.1050 or later. If the update is unavailable for specific sub-versions, the server must be removed from internet-facing exposure immediately.

Proactive Monitoring: Review server logs for suspicious file upload activity, particularly requests directed toward the SWUpdateFileUploader servlet or unexpected creation of .jsp files in the web root.

Compensating Controls: Utilize a Web Application Firewall to block requests containing directory traversal sequences (such as ../) and restrict access to the MagicINFO management interface to trusted internal networks.

Public Exploit Available: Yes (Metasploit module and Nuclei template).

The active exploitation of this vulnerability in the wild makes it a high-priority target for remediation. Administrators must verify their current version and apply the required updates or enforce network-level restrictions immediately to protect the server environment.