CVE-2024-7399: Samsung MagicINFO 9 Server Path Traversal to RCE (KEV, Exploited)

CVE-2024-7399 is a path-traversal vulnerability in Samsung MagicINFO 9 Server, a digital-signage content management server, that lets an attacker write an arbitrary file to the server with system authority; attackers have exploited it in the wild to drop malicious JSP webshells for remote code execution, and researchers later found the originally-announced fix (21.1050) could itself be bypassed.

CVE-2024-7399 is an improper limitation of a pathname to a restricted directory vulnerability (CWE-22) in Samsung MagicINFO 9 Server, Samsung's digital-signage content management platform. NVD's description states: "Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority" (NVD).

NVD's own analysis assigns a Primary CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, full impact to confidentiality, integrity and availability; Samsung's own PSIRT submitted a lower Secondary score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, requiring low privileges), but the NVD Primary figure of 9.8, which models the vulnerability as unauthenticated, governs this page's scoring (NVD). KEV lists a second associated weakness, CWE-434 (unrestricted upload of a dangerous file type), reflecting how the arbitrary-write primitive is used in practice.

Samsung's own security-update page (fetched this run) confirms the issue, tracked internally as SVE-2024-50018 and published under bulletin SVP-AUG-2024, and directs customers to apply the available security patch, though the page does not restate a specific version number beyond what NVD's own CPE data shows (fixed at 21.1050) (Samsung Security Updates).

A third-party write-up from Arctic Wolf (fetched this run) describes active exploitation shortly after SSD Disclosure published technical details and proof-of-concept code: attackers use the path-traversal primitive to "write arbitrary files to the server, which can lead to remote code execution if specially crafted JavaServer Pages (JSP) files are uploaded," without requiring authentication, deploying malicious JSP webshells. Notably, Arctic Wolf reports that version 21.1050 — the version NVD and Samsung describe as fixed — was found to remain vulnerable, with researchers concluding the original patch was incomplete or a related bypass existed, and that no further official patch was available as of that report. Arctic Wolf's recommendation at that point was to remove publicly-exposed MagicINFO 9 instances from the internet entirely (Arctic Wolf).

CISA added CVE-2024-7399 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-04-24 — nearly two years after NVD's original 2024-08-12 publication, reflecting a later wave of exploitation — with a required-action due date of 2026-05-08; known ransomware-campaign use is listed as "Unknown" (catalog confirmed live this run, matched by exact cveID string against the raw KEV feed) (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.9194 — the 99.818th percentile, among the highest EPSS scores tracked on this site — consistent with sustained, confirmed in-the-wild webshell deployment rather than theoretical risk (FIRST EPSS).

Given that the originally-announced fixed version was later reported still exploitable, any internet-reachable MagicINFO 9 Server should not be assumed safe merely by running 21.1050 or later; operators should check Samsung's security-update page for any newer patch, restrict network access to the management interface, and inspect the server for unfamiliar JSP files or webshell activity regardless of patch level.

• Path traversal in Samsung MagicINFO 9 Server before 21.1050 allows attackers to write arbitrary files with system authority. — NVD
• NVD Primary CVSS v3.1 score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; Samsung PSIRT's own Secondary score is 8.8 (requiring low privileges). — NVD
• Samsung tracks this issue internally as SVE-2024-50018 under bulletin SVP-AUG-2024 and directs customers to apply the available patch. — Samsung Security Updates
• Attackers exploit the flaw unauthenticated to write malicious JSP webshells for RCE; version 21.1050, announced as the fix, was later found still exploitable with no further official patch available at the time of that report. — Arctic Wolf
• Added to the CISA KEV catalog on 2026-04-24, due date 2026-05-08; known ransomware campaign use listed as Unknown. — CISA KEV
• EPSS score is 0.9194 (99.818th percentile) as of 2026-10-29. — FIRST EPSS