Every CVESearch/Get API key

CVE-2024-7399

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9...

8.8 HighIn KEVPublic exploit

CVE-2024-7399 is a high vulnerability (CVSS 8.8) in Samsung Magicinfo 9 Server, published August 9, 2024. CISA lists it as known to be exploited, since April 24, 2026. EUVD reports exploitation since April 24, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 91.9%, the 99th percentile. No source names a fixed version.

What does this mean?
Severity
8.8 HighCVSS 3.1, CVE List
Exploit chance
91.9%EPSS, 99th percentile
Exploitation
ExploitedCISA KEV,
Fixed in
No fix listedNo source names one

Description

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

91.9%Up 91.9 points since Aug 13, 2024
90%50%10%1%

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitSamsung MagicINFO 9 Server Remote Code Execution (CVE-2024-7399)2025-04-30
PoC in GitHubdavidxbors/CVE-2024-7399-POC2025-05-30
NucleiSamsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution

What each source reports

CVE List Score used8.8

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.

Record
CVE-2024-7399
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22, CWE-434
Updated
2026-11-02
EUVDEUVD-2024-483308.8

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.

Record
EUVD-2024-48330
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-9x68-238r-w7mq8.8

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9...

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.

Record
GHSA-9x68-238r-w7mq
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
CISA KEVNo score

Samsung MagicINFO 9 Server Path Traversal Vulnerability

Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority.

Record
CVE-2024-7399
Weakness
CWE-22, CWE-434
Updated
2026-11-02
NVD8.8

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.

Record
CVE-2024-7399
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22, CWE-434
Updated
2026-11-02

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open