Is CVE-2024-7399 exploited in the wild?

Yes. CVE-2024-7399 is known to be exploited in the wild, first recorded on 24 April 2026. Treat it as urgent.

How severe is CVE-2024-7399?

Critical severity, with a CVSS score of 9.8, published 24 April 2026.

Which products and versions are affected?

Samsung MagicINFO before 21.1050.

Is there a fix for CVE-2024-7399?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-7399 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2024-7399?

Check whether you run D-Link DIR-823X, Samsung MagicINFO, Samsung MagicINFO 9 Server or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-7399: Samsung MagicINFO 9 Server path traversal

CVE-2024-7399 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-04-24

Samsung MagicINFO 9 Server, a content management platform for digital signage, contains a critical security flaw that allows unauthorized individuals to write files to the server. An attacker could exploit this to gain full control over the system, potentially leading to data theft, service disruption, or the distribution of malicious content across connected displays. This vulnerability is known to be actively exploited in the wild.

Technologies: Samsung MagicINFO 9 Server. Vendors: D-Link, Samsung, Simplehelp.

Quick answers

Is CVE-2024-7399 exploited in the wild?: Yes. CVE-2024-7399 is known to be exploited in the wild, first recorded on 24 April 2026. Treat it as urgent.
How severe is CVE-2024-7399?: Critical severity, with a CVSS score of 9.8, published 24 April 2026.
Which products and versions are affected?: Samsung MagicINFO before 21.1050.
Is there a fix for CVE-2024-7399?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-7399 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2024-7399?: Check whether you run D-Link DIR-823X, Samsung MagicINFO, Samsung MagicINFO 9 Server or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) and unrestricted file upload (CWE-434) exist in Samsung MagicINFO 9 Server versions prior to 21.1050. The flaw stems from improper limitation of pathnames to restricted directories, allowing a remote attacker to bypass directory restrictions. By sending a specially crafted request, an unauthenticated attacker can write arbitrary files to the underlying operating system with system-level privileges. This can lead to remote code execution (RCE) and full system compromise. The vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog.

Affected products

Samsung MagicINFO 9 Server before 21.1050

Identifiers

CVE-2024-7399
CVE-2024-57728
CVE-2025-29635
CVE-2024-57726

Timeline

2024-08-12: disclosed: Initial NVD publication
2026-04-24: kev added: Added to CISA KEV catalog due to active exploitation
2026-04-24: advisory: Updated advisory with exploitation details

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.