CVE-2024-57727

HIGHCVSS 7.5Known Exploited

CISA Known Exploited Vulnerability

https://simple-help.com/kb---security-vulnerabilities-01-2025 ; Additional CISA Mitigation Instructions: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a ; https://nvd.nist.gov/vuln/detail/CVE-2024-57727

Remediation deadline: March 6, 2025

Ransomware use: Known

Description

SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords.

Timeline

Published:January 15th, 2025 11:15 PM

Last modified:August 4th, 2026 5:16 AM

Added to KEV:February 13th, 2025

CVSS Scoring

CVSS v3: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Software

From NVD CPE configuration data

Vendors

simple-help

Products

simplehelp

Weaknesses (CWE)

CWE-22

References & Reports

Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute