{"id":"CVE-2024-7399","published":"2024-08-12T13:38:41Z","modified":"2026-10-01T19:17:15Z","title":"Samsung MagicINFO 9 Server Path Traversal Vulnerability","vendor":"Samsung","product":"MagicINFO 9 Server","tier":"core","eol":null,"description":{"text":"Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a path traversal vulnerability in the Samsung MagicINFO 9 Server product, where improper limitation of pathnames to a restricted directory exists in the server component. An attacker can write arbitrary files with system authority over the network, without authentication, privileges, or user interaction, and the affected versions are those before 21.1050.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:35:57Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.91941,"percentile":0.99819,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2026-04-24","dueDate":"2026-05-08","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://security.samsungtv.com/securityUpdates ; https://nvd.nist.gov/vuln/detail/CVE-2024-7399","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-05-05","exploitedFirstSeen":"2025-05-05","ransomware":false,"evidence":[{"url":"https://arcticwolf.com/resources/blog/cve-2024-7399/","date":"2025-05-05"},{"url":"https://isc.sans.edu/diary/rss/31920","date":"2025-05-05"},{"url":"https://www.huntress.com/blog/rapid-response-samsung-magicinfo9-server-flaw","date":"2025-05-07"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2024-7399","date":"2025-06-07"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-06-16&host_type=src&vulnerability=cve-2024-7399","date":"2025-06-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-06-18&host_type=src&vulnerability=cve-2024-7399","date":"2025-06-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-06-19&host_type=src&vulnerability=cve-2024-7399","date":"2025-06-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-06-20&host_type=src&vulnerability=cve-2024-7399","date":"2025-06-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-06-21&host_type=src&vulnerability=cve-2024-7399","date":"2025-06-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-06-23&host_type=src&vulnerability=cve-2024-7399","date":"2025-06-23"}],"evidenceTotal":88,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"},{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"}],"references":[{"url":"https://security.samsungtv.com/securityUpdates","tags":["Vendor Advisory"]},{"url":"https://arcticwolf.com/resources/blog-uk/arctic-wolf-observes-exploitation-of-path-traversal-vulnerability-in-samsung-magicinfo-9-server-cve-2024-7399/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7399","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote unauthenticated path traversal against public-facing server","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server","start":0,"end":103}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary file write enables placing tools on target","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows attackers to write arbitrary file as system authority","start":127,"end":187}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-48330","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-48330","exploited":true,"exploitedSince":"2026-04-24","provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"Samsung MagicINFO 9 Server Remote Code Execution (CVE-2024-7399)","module":"exploit/windows/http/magicinfo_traversal","type":"exploit","disclosureDate":"2025-04-30","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/magicinfo_traversal.rb"}],"nuclei":[{"id":"CVE-2024-7399","name":"Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution","severity":"high","path":"http/cves/2024/CVE-2024-7399.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7399.yaml"}],"first":{"date":"2025-04-30","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/magicinfo_traversal.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1105"],"provenance":"ai"}],"timeline":[{"date":"2024-08-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7399","provenance":"source"},{"date":"2025-04-30","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/magicinfo_traversal.rb","provenance":"source"},{"date":"2025-05-05","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://arcticwolf.com/resources/blog/cve-2024-7399/","provenance":"source"},{"date":"2026-04-24","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-04-24","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-48330","provenance":"source"}],"speed":{"daysToPublicExploit":261,"firstExploitFrom":"Metasploit","daysToKev":620},"priority":{"score":66.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 545 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9982"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}