CVE-2024-7399

CVE-2024-7399 is a critical path-traversal flaw (CWE-22, tracked alongside CWE-434 unrestricted file upload) in Samsung MagicINFO 9 Server, Samsung's on-premises digital signage content-management platform, affecting all versions before 21.1050. Because the server fails to properly constrain a user-supplied pathname, an unauthenticated remote attacker (CVSS: AV:N/AC:L/PR:N/UI:N) can submit a crafted path and have arbitrary files written outside the intended directory with system authority — typically enabling webshell or malicious payload placement and, in practice, full server compromise. Any organization running an affected MagicINFO 9 Server instance, especially one reachable from the internet, is exposed. Exploitation is confirmed: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-04-24 with a May 2026 federal patching deadline, EPSS assigns a 91.9% probability of exploitation within 30 days (100th percentile), and recent reporting describes threat actors exploiting MagicINFO 9 Server flaws — this traversal and the related CVE-2025-4632 — to deploy the Mirai botnet, though accounts of which specific CVE is in use have been mixed.

What to do: Upgrade MagicINFO 9 Server to version 21.1050 or later per Samsung's advisory; as interim mitigation, restrict internet exposure of the server and inspect the host for unexpected files, webshells, or dropped binaries (e.g., Mirai artifacts) indicating post-exploitation. Federal agencies under BOD 22-01 must apply the update or remove the product by the May 2026 KEV deadline; given the near-certain EPSS score and confirmed in-the-wild use — despite no known public PoC — treat this as a priority patch.