Arbitrary File Write Vulnerability in Samsung MagicINFO 9 Server
CVE-2024-7399

8.8HIGH

Key Information:

Vendor: Samsung Electronics
Status: Magicinfo 9 Server
Vendor: CVE Published:; 12 August 2024

🔔 Create Samsung Electronics Vulnerability Alert

Badges

📈 Trended📈 Score: 2,030💰 Ransomware👾 Exploit Exists🟣 EPSS 65%📰 News Worthy

What is CVE-2024-7399?

CVE-2024-7399 is a critical vulnerability identified in Samsung MagicINFO 9 Server, which functions as a digital signage management platform designed for controlling and distributing multimedia content on Samsung's commercial displays. This software is widely used across various sectors, including transportation networks, retail environments, corporate offices, and healthcare facilities. The vulnerability arises from improper handling of input verification, specifically related to pathnames, enabling unauthorized users to write arbitrary files to the system with elevated privileges. This flaw occurs due to inadequate sanitization of filename inputs, rendering it possible for an attacker to upload malicious scripts that the server executes with system authority. Such exploitation could lead to severe operational disruptions, data breaches, and unauthorized access to sensitive information, significantly impacting organizational integrity and security.

Potential impact of CVE-2024-7399

Remote Code Execution: The vulnerability allows unauthenticated attackers to leverage a path traversal flaw to execute arbitrary code. This control can facilitate the deployment of malicious scripts or web shells, leading to unauthorized administrative access to the system, which can be detrimental to system integrity.
Data Breaches: By exploiting this vulnerability, attackers could gain unauthorized access to sensitive data managed through the MagicINFO platform. This risk is particularly acute as these displays often handle critical information in public and corporate environments, increasing the potential for significant data loss or disclosure.
Botnet Recruitment and DDoS Attacks: The presence of compromised MagicINFO servers has been linked to the Mirai botnet, a collection of hijacked devices used for launching Distributed Denial of Service (DDoS) attacks. This association highlights how exploitation of the vulnerability can contribute to broader cyber threats, using vulnerable systems as part of coordinated attacks against other targets.

Affected Version(s)

MagicINFO 9 Server Windows 0 < 21.1050

News Articles

Rapid7

CVE-2024-7399 CVE-2025-22457

Metasploit Wrap-Up | Rapid7 Blog

Last updated at Thu, 22 May 2025 18:14:26 GMT This week's wrap-up includes many new modules, but notably, we've upgraded Metasploit loading. Thanks to bcoles, the bootup performance when searching for a...