CVE-2024-36071

Samsung Magician 8.0.0 on Windows allows an admin to escalate privileges by tampering with the directory and DLL files used during the installation process. This occurs because of an Untrusted Search Path.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://semiconductor.samsung.com/support/quality-support/product-security-updates/	Vendor Advisory
https://semiconductor.samsung.com/support/quality-support/product-security-updates/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:samsung:magician:8.0.0:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

03 Jun 2025, 16:34

Type	Values Removed	Values Added
CPE		cpe:2.3:a:samsung:magician:8.0.0:::::::* cpe:2.3:o:microsoft:windows:-:::::::*
References	~~() https://semiconductor.samsung.com/support/quality-support/product-security-updates/ -~~	() https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - Vendor Advisory
First Time		Microsoft Microsoft windows Samsung Samsung magician

21 Nov 2024, 09:21

Type	Values Removed	Values Added
References	~~() https://semiconductor.samsung.com/support/quality-support/product-security-updates/ -~~	() https://semiconductor.samsung.com/support/quality-support/product-security-updates/ -

03 Jul 2024, 02:02

Type	Values Removed	Values Added
CWE		CWE-426

21 Jun 2024, 11:22

Type	Values Removed	Values Added
Summary		(es) Samsung Magician 8.0.0 en Windows permite a un administrador escalar privilegios alterando el directorio y los archivos DLL utilizados durante el proceso de instalación. Esto ocurre debido a una ruta de búsqueda que no es de confianza.

20 Jun 2024, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-06-20 21:15

Updated : 2025-06-03 16:34

NVD link : CVE-2024-36071

Mitre link : CVE-2024-36071

CVE.ORG link : CVE-2024-36071

JSON object : View

Products Affected

samsung

magician

microsoft

windows

CWE

CWE-426

Untrusted Search Path

{"id": "CVE-2024-36071", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.3}]}, "published": "2024-06-20T21:15:49.930", "references": [{"url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-426"}]}], "descriptions": [{"lang": "en", "value": "Samsung Magician 8.0.0 on Windows allows an admin to escalate privileges by tampering with the directory and DLL files used during the installation process. This occurs because of an Untrusted Search Path."}, {"lang": "es", "value": "Samsung Magician 8.0.0 en Windows permite a un administrador escalar privilegios alterando el directorio y los archivos DLL utilizados durante el proceso de instalaci\u00f3n. Esto ocurre debido a una ruta de b\u00fasqueda que no es de confianza."}], "lastModified": "2025-06-03T16:34:31.387", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:samsung:magician:8.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "34531F24-ABCD-49CF-BE71-4BC35AF27449"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}

6.3 /10