{"id":"samsung-magicinfo-path-traversal-attacks-apr-2026","category":"patch","status":"closed","title":"Samsung MagicINFO 9 Server file-write flaw CVE-2024-7399 exploited; follow-up fix available","tldr":"Attackers have exploited Samsung MagicINFO 9 Server, business software for managing displays. The original 21.1050 update left a related flaw exposed. Ask IT to install the latest release, currently 21.1092.3, and remove public internet access.","summary":"Samsung MagicINFO 9 Server has a path traversal flaw that lets attackers write files outside permitted folders with Windows system privileges. Samsung identifies versions before 21.1050 as affected by CVE-2024-7399. In May 2025, researchers observed attacks and found that 21.1050 was still vulnerable to an incomplete fix or a separate, similar flaw. Samsung subsequently disclosed CVE-2025-4632, affecting versions before 21.1052; its release notes date hotfix 21.1052.0 to 7 May 2025. CISA listed that flaw as exploited in May 2025 and the original flaw on 24 April 2026. Samsung rates the original flaw High at 8.8, while NVD rates it Critical at 9.8. Fixes are available, with 21.1092.3 the latest release found as of 3 November 2026. The sources do not establish that attacks have stopped; CISA lists ransomware involvement as unknown.","action":"Nothing for you to do if your household does not run MagicINFO Server. If your business uses it, ask its IT provider to update to Samsung's latest release, currently 21.1092.3, and keep the server off the public internet; do not stop at 21.1050.","product":"Samsung MagicINFO 9 Server","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2024-7399","CVE-2025-4632"],"tags":["samsung","magicinfo","windows","path-traversal","actively-exploited","digital-signage"],"affected":["Samsung MagicINFO 9 Server before 21.1050 on Windows — CVE-2024-7399","Samsung MagicINFO 9 Server before 21.1052 — CVE-2025-4632"],"fixed":["MagicINFO 9 Server 21.1050.0 — original CVE-2024-7399 fix; still affected by CVE-2025-4632","MagicINFO 9 Server Hotfix 21.1052.0 — follow-up security fix, installed over 21.1050.0"],"matches":[],"sources":[{"kind":"advisory","title":"Samsung Security Updates — August 2024 and May 2025 advisories","url":"https://security.samsungtv.com/securityUpdates","by":"Samsung","date":"2024-08-08"},{"kind":"advisory","title":"MagicINFO release information, including 21.1052.0 and 21.1092.3","url":"https://docs.samsungvx.com/docs/spaces/flyingpdf/pdfpageexport.action?pageId=60035166","by":"Samsung","date":"2026-07-23"},{"kind":"advisory","title":"CVE-2024-7399 — Samsung CVE record and NVD assessments","url":"https://vulnerability.circl.lu/vuln/CVE-2024-7399","by":"CIRCL","date":"2026-04-25"},{"kind":"advisory","title":"CVE-2025-4632 — Samsung CVE record","url":"https://vulnerability.circl.lu/vuln/CVE-2025-4632","by":"CIRCL","date":"2025-05-13"},{"kind":"research","title":"Follow-Up: Samsung MagicINFO 9 Remains Vulnerable to Ongoing Exploitation","url":"https://arcticwolf.com/resources/blog-uk/arctic-wolf-observes-exploitation-of-path-traversal-vulnerability-in-samsung-magicinfo-9-server-cve-2024-7399/","by":"Arctic Wolf","date":"2025-05-08"},{"kind":"advisory","title":"Known Exploited Vulnerabilities catalogue","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-11-03"}],"started":"2026-04-24","closed":"2026-07-23","created":"2026-11-03T22:22:34.325Z","updated":"2026-11-03T22:22:34.325Z","cve_notes":[{"cve":"CVE-2024-7399","name":"Path traversal in Samsung MagicINFO 9 Server","what":"In MagicINFO 9 Server before 21.1050, inadequate folder restrictions let an attacker write files outside the intended directory with Windows system privileges.","severity":"high","cvss":8.8},{"cve":"CVE-2025-4632","name":"Further path traversal in MagicINFO 9 Server","what":"In MagicINFO 9 Server before 21.1052, a path traversal flaw lets an attacker without a login write files with system privileges, including on version 21.1050.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-07-23","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Samsung released MagicINFO 9 Server 21.1092.3, a later update whose release notes also list authentication bypass and remote code execution fixes.","url":"https://docs.samsungvx.com/docs/spaces/flyingpdf/pdfpageexport.action?pageId=60035166","by":"Samsung","patch":null},{"at":"2026-04-24","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added the original CVE-2024-7399 to its exploited-flaw catalogue, with a federal remediation deadline of 8 May 2026. Ransomware use remained unknown.","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2025-05-22","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2025-4632 to its Known Exploited Vulnerabilities catalogue. It listed ransomware use as unknown.","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2025-05-13","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Samsung published CVE-2025-4632, another path traversal flaw allowing file writes with system privileges. Its affected-version boundary is 21.1052, covering the previously recommended 21.1050 release.","url":"https://vulnerability.circl.lu/vuln/CVE-2025-4632","by":"CIRCL, reproducing Samsung's CVE record","patch":null},{"at":"2025-05-08","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Arctic Wolf reported exploitation observed at the start of May and warned that 21.1050 remained vulnerable. Its bulletin said no official fix was available, whereas Samsung's release notes date hotfix 21.1052.0 to the previous day.","url":"https://arcticwolf.com/resources/blog-uk/arctic-wolf-observes-exploitation-of-path-traversal-vulnerability-in-samsung-magicinfo-9-server-cve-2024-7399/","by":"Arctic Wolf","patch":null},{"at":"2025-05-07","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Samsung's release notes date hotfix 21.1052.0 to 7 May and explicitly list CVE-2024-7399 among its security fixes. The hotfix must be installed over 21.1050.0.","url":"https://docs.samsungvx.com/docs/spaces/flyingpdf/pdfpageexport.action?pageId=60035166","by":"Samsung","patch":"patched"},{"at":"2024-08-08","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Samsung disclosed CVE-2024-7399, which allows attackers to write files with Windows system privileges. Its vulnerability record identifies MagicINFO 9 Server versions before 21.1050 as affected.","url":"https://vulnerability.circl.lu/vuln/CVE-2024-7399","by":"CIRCL, reproducing Samsung's CVE record","patch":"patched"}],"url":"https://hard.fyi/live/samsung-magicinfo-path-traversal-attacks-apr-2026/","json":"https://hard.fyi/api/live?id=samsung-magicinfo-path-traversal-attacks-apr-2026"}