$ cve CVE-2024-7399 JSON

CVE-2024-7399 KEV

8.8

HIGH · CVSS 3.1 · EPSS 91.9% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2026-05-08.

Description

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.

Scoring

CVSS	8.8 (HIGH, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS	91.94% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-22
On CISA KEV	yes — remediate by 2026-05-08
Public exploit	none known
Published	2024-08-12
Last modified	2026-06-17

CISA KEV

Name	Samsung MagicINFO 9 Server Path Traversal Vulnerability
Added	2026-04-24
Due	2026-05-08
Vendor / product	Samsung / MagicINFO 9 Server
Ransomware use	none reported

Affected (1)

Vendor	Product
samsung	magicinfo 9 server

References

https://security.samsungtv.com/securityUpdates
https://arcticwolf.com/resources/blog-uk/arctic-wolf-observes-exploitation-of-path-traversal-vulnerability-in-samsung-magicinfo-9-server-cve-2024-7399/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7399

→ the Explorer · watch your stack · NVD