CVE-2024-57727
SimpleHelp Path Traversal Vulnerability
Published Jan 15, 2025 · updated Aug 3, 2026 · simple-help simplehelp
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.
Timeline
Detection, updates, and resolution for this record.
Jan 15, 2025 · Catalog
Detected
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.
Feb 13, 2025 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Mar 6, 2025 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Aug 3, 2026 · Catalog
Updated
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Mar 6, 2025
Affected
- cpe simple-help/simplehelpversion unspecified
- vendor SimpleHelp SimpleHelpversion unspecified
Sources
- CISA KEVCVE-2024-57727
SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords.
cisa.gov - CVE.orgCVE-2024-57727
Official CVE identifier
cve.org - FIRST EPSSCVE-2024-57727
30-day exploitation probability 96.6%
first.org - Metasploit Modulesauxiliary_scanner/http/simplehelp_toolbox_path_traversal
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2024-57727
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration file
nvd.nist.gov