CVE-2024-7399: Samsung MagicINFO 9 Server path traversal, actively exploited
The short version: Samsung MagicINFO 9 Server — the platform that manages Samsung digital-signage displays — has a path-traversal flaw (CVE-2024-7399) that lets an unauthenticated attacker write an arbitrary file with system authority. Writing a file to the right place turns that into remote code execution, and it has been exploited in the wild, including by botnets. It's in CISA's KEV catalog. If you run MagicINFO 9 Server below 21.1050, patch now. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated file write as system → RCE, KEV-listed and exploited |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVSS (Samsung, CNA) | 8.8 — High · AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~91.94% · 99.81th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediate by 2026-05-08 |
| Known exploited? | Yes — exploited in the wild, including botnet activity |
| Vulnerability type | CWE-22 path traversal + CWE-434 arbitrary file write as system authority → remote code execution |
| Requires authenticated session? | No — NVD scores it pre-authentication |
| Affected | Samsung MagicINFO 9 Server before 21.1050 |
| Fixed in | 21.1050 (and later) |
What you need to know
MagicINFO 9 Server is a content-management system for Samsung commercial displays; instances are frequently reachable over the network so signage can be managed remotely. CVE-2024-7399 is a path traversal in a file-handling endpoint that fails to constrain where a supplied path can point. An attacker uses it to write a file of their choosing to a location of their choosing — and because the write happens with system authority, dropping an executable web resource yields code execution on the host.
- It's unauthenticated and network-reachable. No credential or chain — a single crafted request does the write.
- The write runs as system. That is the difference between "leaks a file" and "owns the box."
- It's KEV-listed and actively exploited. Botnet operators picked it up; an exposed, unpatched server may already be touched.
How serious we see it
High — unauthenticated, network-reachable file write as system, leading to code execution and confirmed exploited.
Samsung's own CNA score (8.8) assumes a privilege the NVD analysis does not; NVD's 9.8 reflects the unauthenticated path, which matches the real-world exploitation we've seen. The bounded, reassuring part is that it's narrow and fixable: it affects MagicINFO 9 Server below 21.1050, the fix is published, and exposure is quick to determine. As with any actively exploited flaw, patch and then verify the server wasn't already used.
Recommendations
- Patch now. Upgrade Samsung MagicINFO 9 Server to 21.1050 or later.
- Hunt. Review the web root and upload directories for files you didn't create, and check logs for anomalous file-handling requests.
- If compromised, respond. Rebuild the server, rotate credentials and keys it holds, and investigate for persistence and lateral movement.
- Reduce exposure. Keep MagicINFO off the public internet where possible; restrict management to trusted networks.
- Confirm your exposure first. Verify whether you run MagicINFO 9 Server and which version.
How BreachRisk sees it
BreachRisk discovers internet-facing MagicINFO panels from little more than your domain, fingerprints the product and version, and flags exposure tied to this KEV-listed, actively exploited flaw — surfaced at the top of your results because it's in KEV. We detect and prioritize the exposed, affected server; the continuous outside-in view means a known-exploited signage server is already mapped, so you can go straight to patch-and-verify.