Actively exploited · Published Jan 15, 2025 · Assigned by mitre
CVE-2024-57727
Critical 9.1 Exploited Ransomware
In plain English
A critical-severity path traversal in SimpleHelp from SimpleHelp . Attackers are actively exploiting it in the wild (listed by CISA on February 13, 2025). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 96.8% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Mar 6, 2025.
Official description
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/
- https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-57727 government-resource