CVE-2024-7399 — Magicinfo 9 Server
HIGHCVE-2024-7399 is a high-severity (CVSS 8.8) Path Traversal vulnerability in samsung magicinfo 9 server. It is in CISA's Known Exploited Vulnerabilities catalog (added 2026-04-24) — treat it as actively exploited and patch now. A fix is available — see the affected versions and patch details below.
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.
Exploitation Status
Actively exploited in the wild
- Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2026-04-24. Federal agencies were required to remediate by 2026-05-08.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA (KEV catalog and SSVC triage) for CVE-2024-7399.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2024-7399 by exploitation likelihood (EPSS) against impact (CVSS). In the shaded patch-first corner (EPSS 50%+, CVSS 7.0+).
Where this sits among everything scored
Of 394,415 CVEs with a current EPSS score, this one falls in the ≥ 90% band (highlighted). Counts from FIRST.org, log-scaled.
Description
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.
Affected Products
magicinfo 9 serversamsungDetection & mitigation playbook
Vendor / applianceDetect
Inventory every samsung magicinfo 9 server deployment and check each version against the affected-products list above.
Fix
Apply the samsung magicinfo 9 server security patch or hotfix for CVE-2024-7399 on the affected version, following the vendor advisory for your exact build.
Workarounds
Treat uploaded files as untrusted until proven otherwise: validate the actual content type rather than the supplied extension, store uploads outside the web root on a volume mounted without execute permission, and rename them to server-generated identifiers so an attacker cannot choose the path a request will later resolve. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
How to detect CVE-2024-7399
A community-maintained Nuclei template exists for this CVE. You can scan for it directly:
nuclei -id cve-2024-7399 -u https://target- Template
- Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution
- Severity
- high
- Impact
- Authenticated attackers can exploit path traversal to write arbitrary JSP files with system privileges, achieving remote code execution and complete server compromise.
- Remediation
- Update Samsung MagicINFO 9 Server to version 21.1050 or later to address the path traversal and arbitrary file write vulnerability.
Template by ProjectDiscovery nuclei-templates (iamnoooob, pdresearch), MIT licensed. View the full template. Scan only systems you are authorised to test.
Frequently Asked Questions
Is CVE-2024-7399 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.