CVE-2024-57727 - SimpleHelp Path Traversal Vulnerability
Project:SimpleHelp
Product:SimpleHelp
Date Added:2025-02-13Due Date:2025-03-06
Vulnerability Name
SimpleHelp Path Traversal Vulnerability
Description
SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords.
Known To Be Used in Ransomware Campaigns?
Known
Action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Additional Notes
https://simple-help.com/kb---security-vulnerabilities-01-2025
https://nvd.nist.gov/vuln/detail/CVE-2024-57727
Related News Articles
FBI: Play ransomware breached 900 victims, including critical orgsJune 5, 2025
DragonForce Exploits SimpleHelp Flaws to Deploy Ransomware Across Customer EndpointsMay 29, 2025
Attackers hit MSP, use its RMM software to deliver ransomware to clientsMay 28, 2025
DragonForce ransomware abuses SimpleHelp in MSP supply chain attackMay 28, 2025
DragonForce ransomware abuses MSP’s SimpleHelp RMM to encrypt customersMay 28, 2025