CISA 2026-04-24

CISA Adds Four Known Exploited Vulnerabilities to Catalog

Machine-generated analysis · WAYSCloud LLM

The advisory adds a command injection flaw in D-Link DIR-823X devices, which could allow remote code execution if exploited.

Context

The affected products include Samsung MagicINFO 9 Server, SimpleHelp, and D-Link DIR-823X routers, all of which are used in enterprise or network environments. The advisory states these vulnerabilities are actively exploited and include path traversal, missing authorization, and command injection types. Worth noting is that SimpleHelp appears twice in the list with two distinct vulnerability types. The advisory does not specify whether exploitation occurs before or after authentication.

Operator considerations

Check: whether Samsung MagicINFO 9 Server, SimpleHelp, or D-Link DIR-823X devices are present in the environment

From Cybersecurity and Infrastructure Security Agency ↗

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2024-7399 Samsung MagicINFO 9 Server Path Traversal Vulnerability

CVE-2024-57726 SimpleHelp Missing Authorization Vulnerability

CVE-2024-57728 SimpleHelp Path Traversal Vulnerability

CVE-2025-29635 D-Link DIR-823X Command Injection Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabi...

Read the full advisory on CISA →