CVE Watch1 oct 2026

CVE-2024-7399

Samsung MagicINFO 9 Server Path Traversal Vulnerability

CVSS

8.8

Alto

EPSS

91.9%

p100

KEV

SÍ

24 abr 2026

Exploit Today

0-100

Publicado: 12 ago 2024 · Última mod.: 1 oct 2026 · CWE-22 · CWE-434

EPSS · 30d

91.9%EPSS · 30 días91.9%

2026-09-162026-10-14

Ficha del catálogo KEV

Producto

Samsung / MagicINFO 9 Server

Vulnerabilidad

Samsung MagicINFO 9 Server Path Traversal Vulnerability

Añadido a KEV

24 abr 2026

Remediar antes de

8 may 2026

Uso conocido en ransomware

Descripción resumida

Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority.

Acción requerida

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://security.samsungtv.com/securityUpdates ; https://nvd.nist.gov/vuln/detail/CVE-2024-7399

Descripción técnica

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-41544—

—

———A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and later6h CVE-2026-24718—

—

———A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later6h CVE-2025-66275—

—

———A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later6h CVE-2025-66272—

—

———A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected.7h CVE-2026-1085879.8 CRÍ

—

———The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This exploit chain requires obtaining the plugin's REST nonce (tenwebio_rest), which is automatically serialized to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses; because the nonce is generated in a cron/loopback context with a user ID of 0, it is valid for unauthenticated visitors.8h