CVE-2024-7399
Samsung MagicINFO 9 Server Path Traversal Vulnerability
Description
CVE-2024-7399 is a HIGH severity path traversal vulnerability in Samsung MagicINFO 9 Server, the centralized digital signage and content-management platform widely deployed for retail, transportation, and corporate signage networks. The flaw — rated CVSS 3.1 8.8 by Samsung and 9.8 (CRITICAL) by NVD — allows attackers to write arbitrary files on the underlying host with system authority, which in practice means full remote code execution against the MagicINFO server. Affected versions are MagicINFO 9 Server prior to 21.1050. CISA added CVE-2024-7399 to the KEV catalog on April 24, 2026, with a remediation deadline of May 8, 2026, after Arctic Wolf observed exploitation in the wild against publicly exposed MagicINFO instances. The EPSS score of 0.823 (99th percentile) confirms widespread, ongoing exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| samsung | magicinfo 9 server | < 21.1050.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://security.samsungtv.com/securityUpdates(Vendor Advisory)
- https://arcticwolf.com/resources/blog-uk/arctic-wolf-observes-exploitation-of-path-traversal-vulnerability-in-samsung-magicinfo-9-server-cve-2024-7399/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7399(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Path Traversal is a vulnerability that occurs when software uses external input to construct a pathname intended to identify a file or directory beneath a restricted parent directory, but fails to neutralize sequences such as ../ that allow the path to resolve outside the intended directory. In Samsung MagicINFO 9 Server, the vulnerable upload handler accepts attacker-controlled file names and writes the uploaded data to a location influenced by those names; because the server runs with system authority, an attacker who escapes the intended upload directory can drop a file anywhere on disk — including locations from which the web tier or operating system will execute it.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-434: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type occurs when software allows users to upload files without properly validating, restricting, or handling the file types — attackers can upload files with dangerous content such as web shells, scripts, or executables. CVE-2024-7399 combines CWE-434 with CWE-22: the upload endpoint not only accepts dangerous file types, but also fails to constrain where they are written. The result is an arbitrary-file-write primitive that the attacker can convert into code execution by placing a malicious JSP or executable in a web-served path.
Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type
Impact Analysis
CVE-2024-7399 is rated 8.8 HIGH by Samsung (vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and 9.8 CRITICAL by NVD (vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The disagreement is over whether authentication is required: NVD's primary scoring treats the vulnerable endpoint as effectively unauthenticated in observed exploitation, which aligns with public exploitation reports. In either scoring, the impact is uniformly High on Confidentiality, Integrity, and Availability, because the flaw lets the attacker write arbitrary files as system authority — the highest privilege on Windows. Successful exploitation yields full takeover of the MagicINFO server, which typically holds signed-in administrator credentials, content packages, scheduled deployments, and persistent connections to remote signage endpoints. From there, the attacker can pivot into the corporate network, replace digital-signage content (a brand and trust-impact concern in retail and transportation), or use the MagicINFO server as a foothold to deploy follow-on payloads. Combined with KEV listing and observed exploitation, CVE-2024-7399 should be treated as critical regardless of which CVSS score is consulted.
Exploit Maturity
Active Exploitation: CISA added CVE-2024-7399 to the KEV catalog on April 24, 2026, after Arctic Wolf published observation of in-the-wild exploitation of CVE-2024-7399 against publicly exposed MagicINFO instances. Exploitation Probability: With an EPSS score of 0.823 (99th percentile), the model rates this vulnerability as having a near-certain probability of continued exploitation in the next 30 days. Exploit Complexity: The path traversal/file-upload chain is straightforward to weaponize — attackers send a single HTTP request with a crafted filename to drop a JSP or web shell, then make a follow-up request to the dropped file to gain code execution as system authority. Practical Risk: MagicINFO 9 Server is commonly deployed on a public-facing port for remote management of signage networks, which makes it especially attractive to opportunistic scanners. Defenders should assume that any unpatched, internet-exposed MagicINFO 9 Server is already being probed.
Remediation
- Upgrade to MagicINFO 9 Server 21.1050 or later. This is the official fix released by Samsung — see the Samsung TV security updates page for the advisory. Confirm post-upgrade that the build number reflects the patched release.
- Remove internet exposure. MagicINFO 9 Server should not be reachable from the public internet. Place the server behind a VPN or restrict the management interface to specific administrative IP ranges. If exposure is unavoidable, deploy a WAF in front of the server with rules that block
..sequences and unexpected file extensions in upload paths. - Hunt for compromise indicators. Inspect the MagicINFO web root and uploaded-content directories for unexpected
.jsp,.war,.bat, or.exefiles. Review IIS or Tomcat access logs for anomalous POST requests to upload endpoints, particularly with file-name parameters containing... Check Windows event logs for new services, scheduled tasks, or local accounts created around the time of the suspicious requests. - Rotate credentials and assume signage compromise. Treat administrator credentials, SMB shares, content-source connectors, and certificates stored on the MagicINFO server as exposed. Rotate them and audit any downstream signage endpoints that synced content from the server while it was vulnerable.
- Long-term hardening. Enforce least-privilege on the MagicINFO service account (avoid SYSTEM/system authority where possible), apply the CWE-22 and CWE-434 mitigation guidance — canonicalize paths server-side, validate file types via content inspection rather than extension, store uploaded files outside the web root, and segment the MagicINFO server from the rest of the corporate network.
Technical Details
CVE-2024-7399 is a chained CWE-22 / CWE-434 vulnerability in Samsung MagicINFO 9 Server prior to 21.1050. The vulnerable code path accepts a file upload over HTTP and writes the uploaded payload to disk using a filename derived from attacker-controlled request data without canonicalizing the resulting path against the intended upload directory. Because MagicINFO 9 Server runs with system authority, the resulting arbitrary file write can target any location reachable by the SYSTEM account — including the web application's root directory, where a dropped JSP or similar server-executable file will be served and executed by the embedded application server (Tomcat) on the next request. The CVSS 3.1 vector disagreement between Samsung (PR:L, score 8.8) and NVD (PR:N, score 9.8) reflects whether the upload endpoint can be reached without authentication; observed exploitation suggests at minimum a low-privilege account is sufficient, and in some configurations none is required. With Scope:Unchanged and High impact across all three CIA properties, the practical effect is unauthenticated remote code execution on the MagicINFO host. Because the vulnerability turns into a file-write primitive at SYSTEM authority, traditional path-confinement defenses on the application alone are insufficient — a complete fix requires the patched build plus operational controls (network exposure, WAF, segmentation).
Frequently Asked Questions
Is CVE-2024-7399 being actively exploited?
Yes. CISA added CVE-2024-7399 to the KEV catalog on April 24, 2026, citing Arctic Wolf's observation of in-the-wild exploitation against publicly exposed Samsung MagicINFO 9 Server instances. The EPSS score of 0.823 (99th percentile) reflects near-certain continued exploitation activity.
What products are affected by CVE-2024-7399?
Samsung MagicINFO 9 Server versions before 21.1050 are vulnerable. The fix is available in MagicINFO 9 Server 21.1050.0 or later. Older MagicINFO product lines (e.g. MagicINFO 8) should be confirmed against vendor support status.
How do I fix CVE-2024-7399?
Upgrade to MagicINFO 9 Server 21.1050 or later, remove internet exposure of the server (place it behind a VPN or restrict management to known IP ranges), and hunt the MagicINFO directories and access logs for indicators of prior compromise such as unexpected JSP/web-shell files or anomalous upload requests.
How severe is CVE-2024-7399?
CVE-2024-7399 is rated HIGH by Samsung (CVSS 3.1 score 8.8) and CRITICAL by NVD (score 9.8). Combined with KEV listing, EPSS 99th-percentile exploitation probability, and confirmed observation in the wild by Arctic Wolf, defenders should treat any unpatched, internet-exposed MagicINFO 9 Server as a critical-priority remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.