CVE-2024-7399

Published Aug 12, 2024

Last updated 14 days ago

Samsung MagicINFO 9 Server

MagicINFO Server

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-7399 is a path traversal vulnerability affecting Samsung MagicINFO 9 Server versions 21.1050 and earlier. This flaw stems from improper input verification, allowing unauthenticated attackers to upload arbitrary files, such as JavaServer Pages (JSP) files, to the server. By exploiting this, threat actors can execute arbitrary code with system authority on vulnerable servers. Although Samsung released a patch for this vulnerability in August 2024, active exploitation in the wild was observed starting in April 2025, shortly after a proof-of-concept (PoC) exploit was made public. Attackers have been leveraging CVE-2024-7399 to infect compromised MagicINFO servers with Mirai botnet malware.

Description: Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.
Source: PSIRT@samsung.com
NVD status: Analyzed
Products: magicinfo_9_server

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Samsung MagicINFO 9 Server Path Traversal Vulnerability
Exploit added on: Apr 24, 2026
Exploit action due: May 8, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

PSIRT@samsung.com: CWE-22
nvd@nist.gov: CWE-22

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:samsung:magicinfo_9_server:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "98EA3132-512C-4B61-87B1-07C927DEDFBB",
            "versionEndExcluding": "21.1050.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.