CVE-2024-7399

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Oct 1, 2026

Description

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22 CWE-434

Affected software

Vendor	Product	Versions
Samsung Electronics	MagicINFO 9 Server	< 21.1050

References

https://security.samsungtv.com/securityUpdatesVendor Advisory
https://arcticwolf.com/resources/blog-uk/arctic-wolf-observes-exploitation-of-path-traversal-vulnerability-in-samsung-magicinfo-9-server-cve-2024-7399/Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7399US Government Resource

Timeline

Published: Aug 12, 2024
Last modified: Oct 1, 2026
Added to CISA KEV: Apr 24, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-74008.5The vulnerability potentially allowed an attacker to misuse ESET’s file operations during the removal of a detected file on the Windows oper CVE-2024-74017.5Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a static token “Orgkey” as authenti CVE-2024-74027.0Netskope has identified a potential gap in its agent (Netskope Client) in which a malicious insider can potentially tamper the Netskope Clie CVE-2024-74046.5An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and st CVE-2024-74078.2Use of a custom password encoding algorithm in Streamsoft Prestiż software allows straightforward decoding of passwords using their encoded CVE-2024-74086.5This vulnerability exists in Airveda Air Quality Monitor PM2.5 PM10 due to transmission of sensitive information in plain text during AP pai CVE-2024-74097.5A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during sock CVE-2024-74105.3The My Custom CSS PHP & ADS plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.3. This is du CVE-2024-74115.3The Newsletters plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 4.9.9. This is due the plug CVE-2024-74125.3The No Update Nag plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.12. This is due to th CVE-2024-74135.3The Obfuscate Email plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.8.1. This is due to t CVE-2024-74145.3The PDF Builder for WPForms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.116. This i