CVE-2024-57727: SimpleHelp path traversal allows unauthenticated file download

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote file disclosure of secrets and password hashes, with confirmed exploitation in the wild and known ransomware campaign use.

What it is

SimpleHelp remote support software v5.5.7 and earlier contains multiple path traversal flaws that let unauthenticated remote attackers download arbitrary files from the host via crafted HTTP requests. Exposed files include server configuration files holding secrets and hashed user passwords, making this a direct route to credential and secret theft.

Impact

An attacker gains read access to arbitrary files on the SimpleHelp host, including configuration data with secrets and hashed user passwords, which can enable further compromise of the server and connected systems.

Attack surface

Reachable over the network via crafted HTTP requests with no authentication and no user interaction required, per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Any internet- or network-exposed SimpleHelp instance at the affected version is in scope.

Exploitation

Listed in CISA KEV with a due date of 2025-03-06 and flagged for known ransomware campaign use, and EPSS shows a 30-day probability of 0.95151 (99.861st percentile), indicating active, widespread exploitation.

What to do

• Upgrade SimpleHelp to a version later than 5.5.7 per the vendor's security advisory.
• If patching is not immediately possible, remove SimpleHelp from direct internet exposure and restrict access to trusted networks or VPN.
• Rotate all secrets and credentials stored in SimpleHelp configuration files, and force password resets for affected accounts.
• Review SimpleHelp host logs for unauthorized file access and treat any exposure as a potential compromise.
• Apply the mitigations in the CISA KEV required action or discontinue use of the product if mitigations are unavailable.

Detection

• Search HTTP request logs for path traversal patterns (e.g., ../ sequences) targeting SimpleHelp endpoints.
• Monitor for anomalous downloads of SimpleHelp configuration files or other sensitive files from the host.
• Alert on unexpected outbound connections or authentication attempts using SimpleHelp credentials following suspicious file access.
• Correlate SimpleHelp host file access events with known exploitation indicators from the vendor and Horizon3 advisories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.