CVE WatchOct 1, 2026

CVE-2024-7399

Samsung MagicINFO 9 Server Path Traversal Vulnerability

CVSS

8.8

High

EPSS

91.9%

p100

KEV

YES

Apr 24, 2026

Exploit Today

0-100

Published: Aug 12, 2024 · Last modified: Oct 1, 2026 · CWE-22 · CWE-434

EPSS · 30d

91.9%EPSS · 30 days91.9%

2026-09-162026-10-14

KEV catalog record

Product

Samsung / MagicINFO 9 Server

Vulnerability

Samsung MagicINFO 9 Server Path Traversal Vulnerability

Added to KEV

Apr 24, 2026

Remediate by

May 8, 2026

Known ransomware use

Summary description

Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://security.samsungtv.com/securityUpdates ; https://nvd.nist.gov/vuln/detail/CVE-2024-7399

Technical description

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-41544—

—

———A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and later6h CVE-2026-24718—

—

———A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later6h CVE-2025-66275—

—

———A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later6h CVE-2025-66272—

—

———A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected.7h CVE-2026-1085879.8 CRI

—

———The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This exploit chain requires obtaining the plugin's REST nonce (tenwebio_rest), which is automatically serialized to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses; because the nonce is generated in a cron/loopback context with a user ID of 0, it is valid for unauthenticated visitors.8h