MagicINFO 9 Server - Path Traversal (CVE-2024-7399)
Description
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.
psychologyCrowdSec Analysis
CVE-2024-7399 is a vulnerability in Samsung MagicINFO Server that permits attackers to write arbitrary files outside of intended directories, leading to possible escalation of privileges.
CrowdSec has been tracking this vulnerability and its exploits since 1st of June 2025.
CrowdSec network data shows that most actors exploiting CVE-2024-7399 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. In addition, according to the CrowdSec network, attack volume against CVE-2024-7399 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.
Incidents typically involve requests to URLs containing /magicinfo/servlet/swupdatefileuploader, aiming to exploit directory traversal weaknesses.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-08-09 |
| Rule Released | 2025-06-01 |
| CrowdSec First Seen | 2025-06-05 |
| CISA KEV | 2026-04-24 |
| CISA Remediation Deadline | 2026-05-08 |
Related Weaknesses
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.