{"id":"CVE-2024-57727","published":"2025-01-15T23:15:09Z","modified":"2026-08-04T05:16:31Z","title":"SimpleHelp Path Traversal Vulnerability","vendor":"SimpleHelp ","product":"SimpleHelp","tier":"core","eol":null,"description":{"text":"SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.","provenance":"source","from":"NVD"},"summary":{"text":"The SimpleHelp remote support software, version 5.5.7 and earlier, contains multiple path traversal flaws in how it handles pathnames, where the server fails to restrict file access to an intended directory. An unauthenticated remote attacker can exploit these by sending crafted HTTP requests to download arbitrary files from the SimpleHelp host, including server configuration files holding secrets and hashed user passwords.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:17Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.96833,"percentile":0.99887,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-02-13","dueDate":"2025-03-06","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://simple-help.com/kb---security-vulnerabilities-01-2025 ; Additional CISA Mitigation Instructions: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a ; https://nvd.nist.gov/vuln/detail/CVE-2024-57727","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-01-31","exploitedFirstSeen":"2025-01-31","ransomware":true,"evidence":[{"url":"https://x.com/curatedintel/status/1885379463682109525?s=46&t=-dkNDSDHEzyAagaVN0SDgA","date":"2025-01-31"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-04&host_type=src&vulnerability=cve-2024-57727","date":"2025-02-04"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-05&host_type=src&vulnerability=cve-2024-57727","date":"2025-02-05"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-11&host_type=src&vulnerability=cve-2024-57727","date":"2025-02-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-12&host_type=src&vulnerability=cve-2024-57727","date":"2025-02-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-13&host_type=src&vulnerability=cve-2024-57727","date":"2025-02-13"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-02-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-14&host_type=src&vulnerability=cve-2024-57727","date":"2025-02-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-15&host_type=src&vulnerability=cve-2024-57727","date":"2025-02-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-16&host_type=src&vulnerability=cve-2024-57727","date":"2025-02-16"}],"evidenceTotal":48,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"INC and The Gentlemen Ransomware: Exposed AI Infrastructure","url":"https://otx.alienvault.com/pulse/6ae254acfd783d5b63290659","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"EbeeOct2026 Pt5","url":"https://otx.alienvault.com/pulse/6ae189b2042138c108f4126b","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"INC and The Gentlemen Ransomware: Exposed AI Infrastructure","url":"https://otx.alienvault.com/pulse/6ad8db024c84442cd0085496","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier","tags":["Release Notes"]},{"url":"https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-57727","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"exploitation_technique","evidence":[],"comment":"Due to improper handling of HTTP request input, attackers can exploit a path traversal vulnerability in SimpleHelp version 5.5.7 and prior to gain access to critical user data stored in SimpleHelp, such as credentials. From there, with the credentials, they can further compromise the system, such as with code execution.","confidence":"high"},{"id":"T1003","name":"OS Credential Dumping","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"primary_impact","evidence":[],"comment":"Due to improper handling of HTTP request input, attackers can exploit a path traversal vulnerability in SimpleHelp version 5.5.7 and prior to gain access to critical user data stored in SimpleHelp, such as credentials. From there, with the credentials, they can further compromise the system, such as with code execution.","confidence":"high"},{"id":"T1552.001","name":"Credentials In Files","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"primary_impact","evidence":[],"comment":"Due to improper handling of HTTP request input, attackers can exploit a path traversal vulnerability in SimpleHelp version 5.5.7 and prior to gain access to critical user data stored in SimpleHelp, such as credentials. From there, with the credentials, they can further compromise the system, such as with code execution.","confidence":"high"},{"id":"T1552.004","name":"Private Keys","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"primary_impact","evidence":[],"comment":"Due to improper handling of HTTP request input, attackers can exploit a path traversal vulnerability in SimpleHelp version 5.5.7 and prior to gain access to critical user data stored in SimpleHelp, such as credentials. From there, with the credentials, they can further compromise the system, such as with code execution.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"secondary_impact","evidence":[],"comment":"Due to improper handling of HTTP request input, attackers can exploit a path traversal vulnerability in SimpleHelp version 5.5.7 and prior to gain access to critical user data stored in SimpleHelp, such as credentials. From there, with the credentials, they can further compromise the system, such as with code execution.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-53725","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-53725","exploited":true,"exploitedSince":"2025-02-13","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-01-17","earliestUrl":"https://github.com/imjdl/CVE-2024-57727","repos":[{"name":"imjdl/CVE-2024-57727","url":"https://github.com/imjdl/CVE-2024-57727","stars":15,"created":"2025-01-17"}]},"metasploit":[{"name":"SimpleHelp Path Traversal Vulnerability CVE-2024-57727","module":"auxiliary/scanner/http/simplehelp_toolbox_path_traversal","type":"auxiliary","disclosureDate":"2025-01-12","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/simplehelp_toolbox_path_traversal.rb"}],"nuclei":[{"id":"CVE-2024-57727","name":"SimpleHelp <= 5.5.7 - Unauthenticated Path Traversal","severity":"high","path":"http/cves/2024/CVE-2024-57727.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-57727.yaml"}],"first":{"date":"2025-01-12","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/simplehelp_toolbox_path_traversal.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1003","T1552.001","T1552.004"],"provenance":"source"},{"stage":"secondary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2025-01-12","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2025-01-17","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/simplehelp_toolbox_path_traversal.rb","provenance":"source"},{"date":"2025-01-15","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57727","provenance":"source"},{"date":"2025-01-31","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://x.com/curatedintel/status/1885379463682109525?s=46&t=-dkNDSDHEzyAagaVN0SDgA","provenance":"source"},{"date":"2025-02-13","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-02-13","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-53725","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":29},"priority":{"score":78.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 637 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9989"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}