CVE-2024-7399: Samsung MagicINFO 9 Server path traversal allows arbitrary file write

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, KEV-listed with active exploitation, and a pre-authentication network-reachable arbitrary file write at system authority make this an urgent patch.

What it is

Samsung MagicINFO 9 Server before version 21.1050 contains a path traversal flaw (CWE-22) that also enables unrestricted file upload (CWE-434), letting an attacker write arbitrary files with system authority. Because the server is network-facing and the write occurs at system privilege level, this is a severe pre-authentication risk to any exposed deployment.

Impact

An attacker can write arbitrary files as system authority, which typically enables planting executable or configuration content and can lead to full server compromise. The record does not state whether code execution is directly achieved, but the write primitive at system privilege is the core gain.

Attack surface

Reached over the network per the CVSS vector AV:N with no privileges (PR:N) and no user interaction (UI:N), so any internet- or network-exposed MagicINFO 9 Server instance is a candidate target. The description does not specify the exact endpoint or parameter used.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog with a 2026-04-24 addition date, and EPSS shows a 30-day probability of 0.91941 (99.8th percentile), indicating active exploitation is expected or observed. A third-party advisory reference also reports observed exploitation.

What to do

• Upgrade Samsung MagicINFO 9 Server to version 21.1050 or later per the vendor advisory.
• If patching is not immediately possible, restrict network access to the MagicINFO 9 Server to trusted management networks and remove internet exposure.
• Follow CISA BOD 22-01 guidance for cloud services and apply the vendor's required mitigations by the 2026-05-08 due date.
• Discontinue use of the product if no mitigation is available, as directed by the KEV entry.
• Audit file write permissions and service account privileges on the server to limit the impact of a successful write.

Detection

• Monitor for file creation or modification events in server directories by the MagicINFO service account, especially unexpected executables or scripts.
• Inspect web server and application logs for path traversal sequences (../, encoded variants) in requests to MagicINFO endpoints.
• Alert on outbound network connections or new processes spawned by the MagicINFO 9 Server process.
• Review file integrity monitoring baselines for the MagicINFO installation directory and flag deviations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.