8.8HIGHCISA KEV — actively exploited

CVE-2024-7399 — Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server…

Samsung · Magicinfo 9 Server · Published 12 Aug 2024 · Modified 1 Oct 2026

Description

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.

References

https://security.samsungtv.com/securityUpdates
https://arcticwolf.com/resources/blog-uk/arctic-wolf-observes-exploitation-of-path-traversal-vulnerability-in-samsung-magicinfo-9-server-cve-2024-7399/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7399

What to do

Check whether Magicinfo 9 Server is in your asset inventory.
Exploitation confirmed — patch within 72 hours.
Record the decision in your risk register for audit evidence.

Alert me on similar CVEs →

Link: adminadda.com/cve/CVE-2024-7399