CVE-2024-7399KEV · OVERDUECWE-22CWE-434path-traversalunrestricted-file-upload

Samsung MagicINFO 9 Server Path Traversal Vulnerability

High · published August 12, 2024

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.

168

days past CISA
deadline

CVSS v3.1

8.8

EPSS

92%

Percentile

99.8

In the wild

Confirmed

What it is

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.91941 · 99.8th percentile
Weaknesses: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-434 · Unrestricted Upload of File with Dangerous Type
Published: 2024-08-12T17:38Z
KEV added: 2026-04-24 · due 2026-05-08

Affected products (1)

Product	Versions	Fixed in
samsung/magicinfo_9_server	< 21.1050.0	21.1050.0

References (3)

https://security.samsungtv.com/securityUpdates · [email protected]https://arcticwolf.com/resources/blog-uk/arctic-wolf-observes-exploitation-of-path-traversal-vulnerability-in-samsung-magicinfo-9-server-cve-2024-7399/ · 134c704f-9b21-4f2e-91b3-4a467353bcc0 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7399 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

24 APR 00:00Z
Added to CISA KEV — remediate by May 8
kev
09 AUG 04:43Z
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write…
cvelistv5