NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Samsung MagicINFO 9 Server file-write flaw CVE-2024-7399 exploited; follow-up fix available

Attackers have exploited Samsung MagicINFO 9 Server, business software for managing displays. The original 21.1050 update left a related flaw exposed. Ask IT to install the latest release, currently 21.1092.3, and remove public internet access.

What to do

Nothing for you to do if your household does not run MagicINFO Server. If your business uses it, ask its IT provider to update to Samsung's latest release, currently 21.1092.3, and keep the server off the public internet; do not stop at 21.1050.

What’s happening

Samsung MagicINFO 9 Server has a path traversal flaw that lets attackers write files outside permitted folders with Windows system privileges. Samsung identifies versions before 21.1050 as affected by CVE-2024-7399. In May 2025, researchers observed attacks and found that 21.1050 was still vulnerable to an incomplete fix or a separate, similar flaw. Samsung subsequently disclosed CVE-2025-4632, affecting versions before 21.1052; its release notes date hotfix 21.1052.0 to 7 May 2025. CISA listed that flaw as exploited in May 2025 and the original flaw on 24 April 2026. Samsung rates the original flaw High at 8.8, while NVD rates it Critical at 9.8. Fixes are available, with 21.1092.3 the latest release found as of 3 November 2026. The sources do not establish that attacks have stopped; CISA lists ransomware involvement as unknown.

What
Flaw
Affects
Samsung MagicINFO 9 Server
Affected
Samsung MagicINFO 9 Server before 21.1050 on Windows — CVE-2024-7399
Samsung MagicINFO 9 Server before 21.1052 — CVE-2025-4632
Fixed in
MagicINFO 9 Server 21.1050.0 — original CVE-2024-7399 fix; still affected by CVE-2025-4632
MagicINFO 9 Server Hotfix 21.1052.0 — follow-up security fix, installed over 21.1050.0
CVE
CVE-2024-7399, CVE-2025-4632
Since
24 Apr 2026
Closed
23 July 2026

Timeline

  1. New fix

    Samsung released MagicINFO 9 Server 21.1092.3, a later update whose release notes also list authentication bypass and remote code execution fixes.

  2. CISA added

    CISA added the original CVE-2024-7399 to its exploited-flaw catalogue, with a federal remediation deadline of 8 May 2026. Ransomware use remained unknown.

  3. CISA added

    CISA added CVE-2025-4632 to its Known Exploited Vulnerabilities catalogue. It listed ransomware use as unknown.

  4. Vendor revised

    Samsung published CVE-2025-4632, another path traversal flaw allowing file writes with system privileges. Its affected-version boundary is 21.1052, covering the previously recommended 21.1050 release.

  5. Wider attacks

    Arctic Wolf reported exploitation observed at the start of May and warned that 21.1050 remained vulnerable. Its bulletin said no official fix was available, whereas Samsung's release notes date hotfix 21.1052.0 to the previous day.

  6. New fixFixed

    Samsung's release notes date hotfix 21.1052.0 to 7 May and explicitly list CVE-2024-7399 among its security fixes. The hotfix must be installed over 21.1050.0.

  7. Made publicFixed

    Samsung disclosed CVE-2024-7399, which allows attackers to write files with Windows system privileges. Its vulnerability record identifies MagicINFO 9 Server versions before 21.1050 as affected.

Sources

  1. Samsung Security Updates — August 2024 and May 2025 advisoriesSamsung · 8 Aug 2024
  2. MagicINFO release information, including 21.1052.0 and 21.1092.3Samsung · 23 July 2026
  3. CVE-2024-7399 — Samsung CVE record and NVD assessmentsCIRCL · 25 Apr 2026
  4. CVE-2025-4632 — Samsung CVE recordCIRCL · 13 May 2025
  5. Follow-Up: Samsung MagicINFO 9 Remains Vulnerable to Ongoing ExploitationArctic Wolf · 8 May 2025
  6. Known Exploited Vulnerabilities catalogueCISA · 3 Nov 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from April 2026 · JSON · RSS