CVE-2024-7399

Description

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.

Overview

State: PUBLISHED
Assigner (CNA): samsung.tv_appliance
CVSS severity: HIGH
CVSS score: 8.8 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Effective score: 8.8 / 10 HIGH source: CNA overview
CWE(s): CWE-22, CWE-434
Reserved: 2024-08-02
Published: 2024-08-09 04:43 UTC
Last updated: 2026-04-25 03:55 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7399.json
Linked Threat: CVE-2024-7399 — Samsung MagicINFO 9 Server: Samsung MagicINFO 9 Server Path Traversal Vulnerability

CISA Known Exploited Vulnerabilities CISA KEV

CISA has confirmed in-the-wild exploitation of this CVE. Federal agencies must remediate by the due date below; private orgs should treat it as priority-1.

Vulnerability name: Samsung MagicINFO 9 Server Path Traversal Vulnerability
Vendor / project: Samsung
Product: MagicINFO 9 Server
Date added to KEV: 2026-04-24
Remediation due: 2026-05-08
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware campaign use: Unknown
CISA notes: https://security.samsungtv.com/securityUpdates ; https://nvd.nist.gov/vuln/detail/CVE-2024-7399
CISA listing: www.cisa.gov/known-exploited-vulnerabilities-catalog

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2024-08-12 13:38:41 UTC
NVD last modified: 2026-04-24 20:23:57 UTC
NVD CVSS v3.1: 8.8 / 10 HIGH source: PSIRT@samsung.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore: 2.8 / 10
Impact subscore: 5.9 / 10
EPSS score: 0.7071 (probability of exploitation in next 30 days)
EPSS percentile: 98.72% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2024-48330
Assigner: samsung.tv_appliance
Published: Aug 9, 2024, 4:43:29 AM
Updated: Apr 25, 2026, 3:55:30 AM
EUVD base score (CVSS 3.1): 8.8 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EUVD-reported EPSS: 70.7100
Vendors: Samsung Electronics
Products: MagicINFO 9 Server (0 <21.1050)
Aliases: GHSA-9x68-238r-w7mq

ENISA description: Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.

EUVD references (1)

https://security.samsungtv.com/securityUpdates

Affected products (1)

Vendor	Product	Versions	Platforms
Samsung Electronics	MagicINFO 9 Server	`0` (affected)	Windows

Affected products — CPE 2.3 (1) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:a:samsung:magicinfo_9_server:*:*:*:*:*:*:*:*

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

https://security.samsungtv.com/securityUpdates vendor-advisory

MITRE references (1) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://security.samsungtv.com/securityUpdates vendor-advisory

Web references (5)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

http://cwe.mitre.org/data/definitions/22.html rapid7:cwe.mitre.org
http://cwe.mitre.org/data/definitions/434.html rapid7:cwe.mitre.org
https://attackerkb.com/topics/CVE-2024-7399 rapid7:attackerkb.com
https://nvd.nist.gov/vuln/detail/CVE-2024-7399 rapid7:nvd.nist.gov
https://www.cve.org/CVERecord?id=CVE-2024-7399 rapid7:www.cve.org

NVD-tagged references (3)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://arcticwolf.com/resources/blog-uk/arctic-wolf-observes-exploitation-of-path-traversal-vulnerability-in-samsung-magicinfo-9-server-cve-2024-7399/ 134c704f-9b21-4f2e-91b3-4a467353bcc0 Third Party Advisory
https://security.samsungtv.com/securityUpdates PSIRT@samsung.com Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7399 134c704f-9b21-4f2e-91b3-4a467353bcc0 US Government Resource

Indicators (3)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
cwe	`CWE-22`	no local data	2026-05-14 02:58 UTC
cve	`CVE-2024-7399`	no local data	2026-05-14 02:58 UTC
cwe	`CWE-434`	no local data	2026-05-14 02:58 UTC

Remediations (9)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Dangerous Fake Microsoft Windows Update Confirmed—Do Not Download

web:www.forbes.com

As security researchers warn about a dangerous Microsoft Windows update that isn't legitimate, users must pay close attention to what they are actually downloading.

2026-05-14 07:18 UTC
Remediate vulnerabilities with Microsoft Defender Vulnerability ...

web:learn.microsoft.com

Remediate security weaknesses discovered through security recommendations, and create exceptions if needed, in Defender Vulnerability Management.

2026-05-14 07:18 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-14 07:18 UTC
KB4073119: Windows client guidance for IT Pros to protect against ...

web:support.microsoft.com

Provides Windows client guidance for IT Pros to protect against speculative execution side-channel vulnerabilities.

2026-05-14 07:18 UTC
Microsoft January 2026 Patch Tuesday fixes 3 zero-days, 114 flaws

web:www.bleepingcomputer.com

Today is Microsoft's January 2026 Patch Tuesday with security updates for 114 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.

2026-05-14 07:18 UTC
Microsoft addresses 137 vulnerabilities in May's Patch Tuesday ...

web:cyberscoop.com

Threats Microsoft addresses 137 vulnerabilities in May's Patch Tuesday, including 13 rated critical The high volume of vulnerabilities reflects a growing trend researchers have been anticipating as artificial intelligence models are deployed to find previously uncovered defects in code.

2026-05-14 07:18 UTC
Microsoft's new AI system finds 16 Windows flaws, including four ...

web:www.csoonline.com

Microsoft has unveiled a new AI-driven vulnerability discovery system that identified 16 previously unknown Windows vulnerabilities, including four critical remote code execution flaws, in what ...

2026-05-14 07:18 UTC
CVE: Common Vulnerabilities and Exposures

web:www.cve.org

At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

2026-05-14 07:18 UTC
CISA Required Action

CISA KEV

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-05-08 Known ransomware campaign use: Unknown

2026-05-14 01:13 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2024-7399.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-7399",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-07T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-04-24",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7399"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-25T03:55:30.861Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://arcticwolf.com/resources/blog-uk/arctic-wolf-observes-exploitation-of-path-traversal-vulnerability-in-samsung-magicinfo-9-server-cve-2024-7399/"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7399"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-24T00:00:00.000Z",
            "value": "CVE-2024-7399 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "MagicINFO 9 Server",
          "vendor": "Samsung Electronics",
          "versions": [
            {
              "lessThan": "21.1050",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Anonymous working with Trend Mirco Zero Day Initiative"
        }
      ],
      "datePublic": "2024-08-08T23:09:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority."
            }
          ],
          "value": "Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-650",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-650 Upload a Web Shell to a Web Server"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-09T04:43:29.828Z",
        "orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
        "shortName": "samsung.tv_appliance"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.samsungtv.com/securityUpdates"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
    "assignerShortName": "samsung.tv_appliance",
    "cveId": "CVE-2024-7399",
    "datePublished": "2024-08-09T04:43:29.828Z",
    "dateReserved": "2024-08-02T00:29:57.143Z",
    "dateUpdated": "2026-04-25T03:55:30.861Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}