← CVE Radar
CVE-2024-57727SimpleHelp Path Traversal Vulnerability
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.
9.1 CRITICALEPSS 96.83%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.1 | CRITICAL | 3.1CISA-ADP | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 7.5 | HIGH | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
CISA required action
⚡ Known exploited · remediation due Mar 6, 2025
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2024-57727
- Status
- Analyzed
- Assigner (CNA)
- mitre
- Published
- Jan 15, 2025
- Last modified
- 2026-08-04 05:16 UTC
- Weaknesses
Affected Products
From NVD CPE configurations.
simple-helpsimplehelp1 version range
- before 5.5.8
References
- simple-help.com https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier
- horizon3.ai https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-57727