{"id":"CVE-2024-57727","kind":"vulnerability","aliases":["CVE-2024-57727"],"related":[],"title":"simple-help simplehelp: SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that…","description":"SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"SimpleHelp remote support software has path traversal flaws that let unauthenticated remote attackers download arbitrary files from the server. Downloaded files can include server configuration and hashed user passwords.","severity":"critical","cvss":9.1,"epss":null,"exploited":true,"exploited_at":"2025-02-13T00:00:00+00:00","products":[{"name":"SimpleHelp SimpleHelp","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"simple-help simplehelp","fixed":["5.5.8"],"affected":"< 5.5.8","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","ransomware","remote-support","self-hosted","simplehelp","vendor"],"not_affected_if":["not-running-simplehelp"],"how_to_check":null,"fix":"Apply the mitigations per the vendor instructions, or discontinue use of SimpleHelp if mitigations are unavailable (per CISA required action). Exact fixed version: unknown","status":"open","published_at":"2025-01-15T23:15:09+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:52:26+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T20:52:26Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations per the vendor instructions, or discontinue use of SimpleHelp if mitigations are unavailable (per CISA required action). Exact fixed version: unknown","reach":"internet","impact":"high","summary":"SimpleHelp remote support software has path traversal flaws that let unauthenticated remote attackers download arbitrary files from the server. Downloaded files can include server configuration and hashed user passwords.","category":"vendor","who_cares":["simplehelp","self-hosted","remote-support"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker downloads server config and hashed user passwords without logging in","analyst_note":"Find the SimpleHelp vendor advisory and the exact affected and fixed versions, plus the mitigation steps; check the CISA KEV entry for the due date.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-running-simplehelp"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00045,"input_tokens":2671,"output_tokens":366,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':20A,23A '-57727':21A,24A 'action':109C 'allow':80C 'appli':110C 'arbitrari':55B,86C 'attack':53B,83C 'cisa':107C 'configur':65B,101C 'contain':74C 'craft':93C 'cve':19A,22A 'discontinu':116C 'download':54B,60B,85C 'exploit':31B 'file':56B,61B,87C,97C,102C 'flaw':48B 'hash':67B,104C 'help':3A,29A 'host':38B,91C 'http':94C 'includ':63B,99C 'instruct':114C 'let':50B 'may':98C 'mitig':111C,122C 'multipl':15A,75C 'password':69B,106C 'path':16A,46B,76C 'per':112C 'product':120C 'ransomwar':32B 'remot':6A,34B,42B,52B,71C,82C 'remote-support':33B 'request':95C 'requir':108C 'self':37B 'self-host':36B 'server':59B,64B,100C 'simpl':2A 'simple':28A 'simple-help':1A,27A 'simplehelp':4A,5A,25A,26A,30A,39B,41B,70C,90C 'softwar':8A,44B,73C 'support':7A,35B,43B,72C 'travers':17A,47B,77C 'unauthent':51B,81C 'unavail':124C 'use':117C 'user':68B,105C 'v5.5.7':9A 'vendor':40B,113C 'via':92C 'vulner':13A,18A,78C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-01-15T23:15:09+00:00","kev":{"dateAdded":"2025-02-13","dueDate":"2025-03-06","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-57727","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-57727","severity":null,"published_at":"2025-02-13T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-57727","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57727","severity":null,"published_at":"2025-01-15T23:15:09+00:00","modified_at":"2026-08-04T05:16:31+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}