{"id":"CVE-2024-31953","url":"https://www.cyber-defence.io/tools/cve/CVE-2024-31953","generatedAt":"2026-10-28T08:10:41.815Z","title":"Because it is possible to tamper with the directory and executable files used during the installation process, an attacker can escalate privileges through arbitrary code execution.","description":"An issue was discovered in Samsung Magician 8.0.0 on macOS. Because it is possible to tamper with the directory and executable files used during the installation process, an attacker can escalate privileges through arbitrary code execution. (The attacker must already have user privileges, and an administrator password must be entered during the program installation stage for privilege escalation.)","published":"2024-05-14T15:27:51.000Z","lastModified":"2026-06-17T07:29:00.000Z","status":"Analyzed","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":6.7,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"},"cwe":["CWE-269"],"affected":["samsung/magician"],"epss":{"score":0.00144,"percentile":0.03629,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.14%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-31953/","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-31953/","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-31953","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}