CVE-2024-7399Vulnerability
Samsung MagicINFO 9 Server Path Traversal Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 30 days ago
CISA KEVAdded 24 Apr 2026
Fix due 8 May 2026
Used by ransomware: not knownCISA KEV catalogue
Fix due 8 May 2026
Used by ransomware: not knownCISA KEV catalogue
EPSS91.9%
higher than 99% of CVEsFIRST EPSS, as of 22 Oct 2026
higher than 99% of CVEsFIRST EPSS, as of 22 Oct 2026
What the reports say
2 reports, newest first · the exact sentence from each-
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint“This vulnerability was fixed in May 2025 (after an initial, earlier flaw CVE-2024-7399 was found to have an incomplete fix).”
-
Rapid Response: Samsung MagicINFO 9 Server Flaw“TL;DR: While reports have indicated the latest version of Samsung MagicINFO 9 Server fixes a high-severity flaw (CVE-2024-7399), Huntress has independently verified that the latest version (21.1050.0) is vulnerable to a publicly available proof-of-concept (PoC).”
Indicators reported together
named in the same reports- hxxp://194.87.89[.]30:8899/anydesk.exein 1 report
- 194.87.89[.]30in 1 report
- auto.c3pool[.]orgin 1 report
- 0d202e16408770e8…060315b30dd1in 1 report
Copy these 4 indicators · defanged
Also named with it: CVE-2025-4632
Thanks — we review every report.