CVE-2024-7399

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - PSIRT@samsung.com

Published

2024-08-12

Last modified

2026-10-01

Known exploited (CISA KEV)

since 2026-04-24, action due 2026-05-08: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

CWE-22, CWE-434

Affected products

• Magicinfo 9 Server (Samsung)
• Magicinfo 9 Server (Samsung Electronics)

References

• https://security.samsungtv.com/securityUpdates
• https://arcticwolf.com/resources/blog-uk/arctic-wolf-observes-exploitation-of-path-traversal-vulnerability-in-samsung-m…
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7399