SimpleHelp < 5.5.12 RCE

The version of SimpleHelp running on the remote web server is prior to 5.5.12. It is, therefore, affected by a remote code execution vulnerability due to the inclusion of functionality from an untrusted control sphere. An attacker can use this to bypass authentication and execute arbitrary...

Ransomware Gangs Exploit Unpatched SimpleHelp Flaws to Target Victims with Double Extortion

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday disclosed that ransomware actors are targeting unpatched SimpleHelp Remote Monitoring and Management RMM instances to compromise customers of an unnamed utility billing software provider. "This incident reflects a broader...

Ransomware Gangs Exploit Unpatched SimpleHelp Flaws to Target Victims with Double Extortion

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday disclosed that ransomware actors are targeting unpatched SimpleHelp Remote Monitoring and Management RMM instances to compromise customers of an unnamed utility billing software provider. "This incident reflects a broader...

DragonForce Exploits SimpleHelp Flaws to Deploy Ransomware Across Customer Endpoints

The threat actors behind the DragonForce ransomware gained access to an unnamed Managed Service Provider's MSP SimpleHelp remote monitoring and management RMM tool, and then leveraged it to exfiltrate data and drop the locker on multiple endpoints. It's believed that the attackers exploited a tri...

DragonForce Exploits SimpleHelp Flaws to Deploy Ransomware Across Customer Endpoints

The threat actors behind the DragonForce ransomware gained access to an unnamed Managed Service Provider's MSP SimpleHelp remote monitoring and management RMM tool, and then leveraged it to exfiltrate data and drop the locker on multiple endpoints. It's believed that the attackers exploited a tri...

CVE-2024-57727

SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing...

CVE-2024-57728

SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file i.e. zip slip. This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user...

CVE-2024-57726

SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role...

VulnCheck KEV: CVE-2024-57728

SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file i.e. zip slip. This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user...

VulnCheck KEV: CVE-2024-57726

SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role...

SimpleHelp Detection

Binary data simplehelpwebuidetect.nbin...

Security Updates for SimpleHelp < 5.5.8

The version of SimpleHelp running on the remote web server is prior to 5.3.9, or 5.4.x prior to 5.4.10 or 5.5.x prior to 5.5.8. It is, therefore, affected by multiple vulnerabilities: - Allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to...

SimpleHelp Detected

This is an informational notice that the scanner was able to detect a SimpleHelp instance on the target server. Note that this detection is included in the Remote Access Tools category. No source data...

SimpleHelp Unauthenticated Path Traversal

SimpleHelp versions 5.5.x 5.5.8, 5.4.x 5.4.10 and 5.3.x 5.3.9 suffer from an unauthenticated path traversal vulnerability. By crafting a specific URL, a remote and unauthenticated attacker can access sensitive file such as 'serverconfig.xml' which contains at least the SimpleHelpAdmin user hashed...

PT-2025-7246 · Unknown · Simplehelp

Name of the Vulnerable Software and Affected Versions: SimpleHelp affected versions not specified Description: A vulnerability has been identified in SimpleHelp. CISA has added this issue to the KEV Catalog. Recommendations: At the moment, there is no information about a newer version that contai...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-57727link is external SimpleHelp Path Traversal Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose...

SimpleHelp Path Traversal Vulnerability

SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords...

Hackers Exploiting SimpleHelp RMM Flaws for Persistent Access and Ransomware

Threat actors have been observed exploiting recently disclosed security flaws in SimpleHelp's Remote Monitoring and Management RMM software as a precursor for what appears to be a ransomware attack. The intrusion leveraged the now-patched vulnerabilities to gain initial access and maintain...

VulnCheck KEV: CVE-2024-57727

SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords...

SimpleHelp Privilege Escalation

The vulnerability of SimpleHelp’s software for remote support is related to insecure management of privileges. Exploiting this vulnerability allows a malicious actor to elevate their privileges to the root level...