CVE-2024-57727 Known ransomware use

SimpleHelp Path Traversal Vulnerability

SimpleHelp — SimpleHelp

Added to KEV catalog: 13 February 2025
Federal remediation due date: 6 March 2025
Weakness classification (CWE): CWE-22

CISA Description

SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://simple-help.com/kb---security-vulnerabilities-01-2025 ; Additional CISA Mitigation Instructions: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a ; https://nvd.nist.gov/vuln/detail/CVE-2024-57727

View on NVD View on MITRE CVE View full CISA catalog

More SimpleHelp Vulnerabilities

CVE-2026-48558

SimpleHelp Authentication Bypass Vulnerability

CVE-2024-57728

SimpleHelp Path Traversal Vulnerability

CVE-2024-57726

SimpleHelp Missing Authorization Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services