[KEV] CVE-2024-7399 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2024-7399 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2024-7399 is a path traversal vulnerability in Samsung MagicINFO 9 Server, a digital signage content management platform, that allows an attacker to write arbitrary files with system-level authority.

Technical Detail

The flaw exists in Samsung MagicINFO 9 Server's file handling logic, where insufficient validation of user-supplied path input allows an attacker to traverse outside intended directory boundaries and write files to arbitrary locations on the underlying system. By crafting a malicious request that includes path traversal sequences, an attacker can place files in sensitive system directories, which in practice enables remote code execution by writing web shells or malicious executables that run under system authority. The effective impact is full system compromise, as arbitrary file write with system privileges provides a direct path to persistent access and lateral movement.

Exploitation Status

CISA has confirmed active exploitation in the wild, adding this vulnerability to the Known Exploited Vulnerabilities catalog on April 24, 2026. The exploit maturity is rated Operational, meaning functional exploit code capable of reliable exploitation exists and is being used in real-world attacks, not merely as a proof of concept.

Who Is Targeting This

No specific threat actor attribution has been confirmed at this time. Given the nature of the target platform, which manages public-facing digital signage infrastructure, opportunistic attackers as well as actors interested in persistent access to enterprise or public-sector networks may be motivated to exploit this vulnerability. Targeted sector data is not yet available.

What To Do

Organizations running Samsung MagicINFO 9 Server should apply the vendor-supplied patch immediately. Per CISA's Known Exploited Vulnerabilities catalog, federal agencies operating under BOD 22-01 are required to remediate this vulnerability by the deadline associated with the April 24, 2026 listing date. Administrators should audit MagicINFO Server instances for signs of unauthorized file writes, unexpected web shells, or anomalous processes running under system authority. If patching cannot be completed immediately, consider restricting network access to the MagicINFO Server management interface to trusted IP ranges and monitoring file system activity on affected hosts for indicators of compromise.