Medium severity · published May 14, 2024
CVE-2024-31952
An issue was discovered in Samsung Magician 8.0.0 on macOS
6.7
CVSS
0.2%
EPSS
No
On KEV
Description
An issue was discovered in Samsung Magician 8.0.0 on macOS. Because symlinks are used during the installation process, an attacker can escalate privileges via arbitrary file permission writes. (The attacker must already have user privileges, and an administrator password must be entered during the program installation stage for privilege escalation.)
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Magician · Samsung
8.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-31952
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-31952
Vendor Advisory
https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-31952/
More from Magician
8.8
CVE-2017-3218
Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic
7.8
CVE-2025-57836
An issue was discovered in Samsung Magician 6.3.0 through 8.3.2 on Windows
6.7
CVE-2024-31953
An issue was discovered in Samsung Magician 8.0.0 on macOS
6.3
CVE-2024-36071
Samsung Magician 8.0.0 on Windows allows an admin to escalate privileges by tampering with the directory and DLL files used during the installation process
5.5
CVE-2024-23769
Improper privilege control for the named pipe in Samsung Magician PC Software 8.0.0 (for Windows) allows a local attacker to read privileged data