{"id":"CVE-2024-7399","published":"2024-08-12T13:38:41Z","modified":"2026-10-01T19:17:15Z","title":"Samsung MagicINFO 9 Server Path Traversal Vulnerability","vendor":"Samsung","product":"MagicINFO 9 Server","tier":"core","eol":null,"description":{"text":"Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a path traversal vulnerability in the Samsung MagicINFO 9 Server product, where improper limitation of pathnames to a restricted directory exists in the server component. An attacker can write arbitrary files with system authority over the network, without authentication, privileges, or user interaction, and the affected versions are those before 21.1050.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:35:57Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.91941,"percentile":0.99818,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2026-04-24","dueDate":"2026-05-08","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://security.samsungtv.com/securityUpdates ; https://nvd.nist.gov/vuln/detail/CVE-2024-7399","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-05-05","exploitedFirstSeen":"2025-05-05","ransomware":false,"evidence":[{"url":"https://arcticwolf.com/resources/blog/cve-2024-7399/","date":"2025-05-05"},{"url":"https://isc.sans.edu/diary/rss/31920","date":"2025-05-05"},{"url":"https://www.huntress.com/blog/rapid-response-samsung-magicinfo9-server-flaw","date":"2025-05-07"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2024-7399","date":"2025-06-07"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-06-16&host_type=src&vulnerability=cve-2024-7399","date":"2025-06-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-06-18&host_type=src&vulnerability=cve-2024-7399","date":"2025-06-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-06-19&host_type=src&vulnerability=cve-2024-7399","date":"2025-06-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-06-20&host_type=src&vulnerability=cve-2024-7399","date":"2025-06-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-06-21&host_type=src&vulnerability=cve-2024-7399","date":"2025-06-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-06-23&host_type=src&vulnerability=cve-2024-7399","date":"2025-06-23"}],"evidenceTotal":88,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"},{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"}],"references":[{"url":"https://security.samsungtv.com/securityUpdates","tags":["Vendor Advisory"]},{"url":"https://arcticwolf.com/resources/blog-uk/arctic-wolf-observes-exploitation-of-path-traversal-vulnerability-in-samsung-magicinfo-9-server-cve-2024-7399/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7399","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote unauthenticated path traversal against public-facing server","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server","start":0,"end":103}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary file write enables placing tools on target","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows attackers to write arbitrary file as system authority","start":127,"end":187}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-48330","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-48330","exploited":true,"exploitedSince":"2026-04-24","provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"Samsung MagicINFO 9 Server Remote Code Execution (CVE-2024-7399)","module":"exploit/windows/http/magicinfo_traversal","type":"exploit","disclosureDate":"2025-04-30","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/magicinfo_traversal.rb"}],"nuclei":[{"id":"CVE-2024-7399","name":"Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution","severity":"high","path":"http/cves/2024/CVE-2024-7399.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7399.yaml"}],"first":{"date":"2025-04-30","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/magicinfo_traversal.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1105"],"provenance":"ai"}],"timeline":[{"date":"2024-08-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7399","provenance":"source"},{"date":"2025-04-30","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/magicinfo_traversal.rb","provenance":"source"},{"date":"2025-05-05","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://arcticwolf.com/resources/blog/cve-2024-7399/","provenance":"source"},{"date":"2026-04-24","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-04-24","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-48330","provenance":"source"}],"speed":{"daysToPublicExploit":261,"firstExploitFrom":"Metasploit","daysToKev":620},"priority":{"score":69.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 543 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9982"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}