Hello and welcome to the Tuesday, May 6, 2025 edition of the Sands and the Storm Center's Stormcast.

My name is Johannes Ulrich, and today I'm recording from San Diego, California.

In diaries today, well, I saw some initial attacks against Samsung's Magic Info CMS.

This is somewhat defunct, not quite really sort of maintained piece of software anymore,

but last August Samsung did release a patch for it,

fixing an arbitrary file upload vulnerability that then can lead to remote code execution.

This particular vulnerability was not really noticed much, part probably because of the very sort

of short, sort of one-liner that Samsung published about it. Last week, cybersecurity info did cite some

research report. Sadly, I didn't see a link to the actual research report or any more

attribution to it, but this particular article about the research report did quote it, noting particular URL that's being used to upload these files, and then also some additional details about the vulnerability.

Well, a couple days later, we started seeing some actual exploit attempts.

These exploit attempts appear to be coming from,

well, what's sort of often described, still as Mirai, basically a botnet that does

exploit various vulnerabilities. Often, of course, IOT-style vulnerabilities. This would definitely not necessarily sort of call an IoT-style vulnerability.

It is more a server component used to basically manage content.

That's what CMS content management servers are doing.

Not even sure how successful these exploit are,

but they sort of follow very much the standard pattern

where the initial upload uses a number of different ways,

like TFTP, W-Get, curl, FDP and such,

to download the second stage.

The second stage is then the typical shell script

...