Samsung MagicINFO 9 Path Traversal Vulnerability, CVSS 8.8
Summary
CISA added CVE-2024-7399, a path traversal vulnerability in Samsung MagicINFO 9 Server versions before 21.1050, to its Known Exploited Vulnerabilities catalog. The flaw carries a CVSS 3.1 score of 8.8 (HIGH) and allows authenticated attackers with network access to write arbitrary files as system authority, potentially enabling full system compromise. The vulnerability was reported by an anonymous researcher working with Trend Micro Zero Day Initiative and has been confirmed as actively exploited in the wild since at least May 2025. Organizations running Samsung MagicINFO 9 Server should verify their version and apply the version 21.1050 patch immediately.
“Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.”
IT security and patch management teams should prioritize CVE-2024-7399 remediation for any Samsung MagicINFO 9 Server deployments. CISA's addition to the KEV catalog creates remediation expectations under BOD 22-01 for federal civilian agencies, and the automatable/total-impact SSVC classification signals elevated urgency for all operators. Asset inventory is the immediate prerequisite — without knowing which systems run MagicINFO 9, the patch cannot be applied.
About this source
GovPing monitors CISA Known Exploited Vulnerabilities (KEV) for new data privacy & cybersecurity regulatory changes. Every update since tracking began is archived, classified, and available as free RSS or email alerts — 41 changes logged to date.
What changed
CVE-2024-7399 was formally catalogued by CISA as a Known Exploited Vulnerability, triggering federal civilian executive branch agencies to remediate under BOD 22-01 binding requirements and signalling heightened risk to all affected Samsung MagicINFO 9 Server operators. The vulnerability involves improper path limitation (CWE-22) combined with unrestricted file upload (CWE-434), enabling privilege escalation to SYSTEM authority. CISA has classified the exploitation as active, automatable, and total-impact under SSVC v2.0.3.
Organizations running Samsung MagicINFO 9 Server should immediately inventory deployments, identify versions prior to 21.1050, and apply the vendor security update available at security.samsungtv.com. Organizations unable to patch promptly should consider network isolation and heightened monitoring for anomalous file-write activity, as the CVSS attack vector (network) and low privilege requirement (PR:L) mean the flaw is accessible to a broad range of threat actors.
Archived snapshot
Apr 25, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Required CVE Record Information
CNA: Samsung TV & Appliance
Updated:
2024-08-09
Description
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.
CWE 2 Total
Learn more
- CWE-22: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-434: CWE-434 Unrestricted Upload of File with Dangerous Type
CVSS 1 Total
Learn more
| Score | Severity | Version | Vector String |
| --- | --- | --- | --- |
| 8.8 | HIGH | 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Product Status
Learn more Versions 1 Total
Default Status: unaffected
affected
- affected from 0 before 21.1050
Credits
- Anonymous working with Trend Mirco Zero Day Initiative reporter
References 1 Total
- https://security.samsungtv.com/securityUpdates vendor-advisory
Authorized Data Publishers
CISA-ADP
SSVC and KEV, plus CVSS and CWE if not provided by the CNA.
SSVC 1 Total
Learn more
| Exploitation | Automatable | Technical Impact | Version | Date Accessed |
| --- | --- | --- | --- | --- |
| active | yes | total | 2.0.3 | 2025-05-07 |
KEV 1 Total
Learn more
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7399 (2026-04-24)
Mentioned entities
Related changes
Get daily alerts for CISA Known Exploited Vulnerabilities (KEV)
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CISA.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CISA Known Exploited Vulnerabilities (KEV) publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.