SimpleHelp Path Traversal Vulnerability (CVE-2024-57727)
Severity: high · Patch status: unknown · Since 2025-02-13 · CVE-2024-57727
SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords. CISA added CVE-2024-57727 to its Known Exploited Vulnerabilities catalog on Feb 13, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.
What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- US federal agencies must remediate by Mar 6, 2025 (BOD 22-01); treat that as the outer limit.
Sources
All live incidents on Threat Watch