CVE-2024-57728: SimpleHelp zip slip path traversal allows arbitrary file write and code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw enables code execution on a remote support server, is in CISA KEV with known ransomware use, and has a high CVSS score, though exploitation requires admin privileges.

What it is

SimpleHelp remote support software v5.5.7 and earlier lets admin users upload a crafted zip file that writes files anywhere on the file system via zip slip (path traversal / link following). Because the written files can be placed in executable locations, this leads to arbitrary code execution as the SimpleHelp server user. It matters because SimpleHelp is a remote support tool, and the flaw is listed in CISA KEV with known ransomware campaign use.

Impact

An attacker with admin access gains arbitrary file write on the host and can escalate that to code execution in the context of the SimpleHelp server user, potentially compromising the support server and any managed endpoints.

Attack surface

Reached over the network through the SimpleHelp file upload functionality; the CVSS vector requires high privileges (PR:H) and no user interaction (UI:N). The description states the actor must be an admin user, so valid administrative access is a prerequisite.

Exploitation

CVE-2024-57728 is in CISA KEV (added 2026-04-24, due 2026-05-08) with known ransomware campaign use, and EPSS shows a 30-day probability of 0.06982 (93.8th percentile). References include vendor, Horizon3.ai, CISA and Microsoft reporting on Storm-1175/Medusa ransomware activity.

What to do

• Upgrade SimpleHelp to a version later than 5.5.7 per the vendor advisory; patch first.
• If patching is not immediately possible, restrict or disable the file upload feature and limit admin accounts to trusted personnel.
• Run the SimpleHelp server with least privilege and not as a highly privileged account, and isolate it from sensitive network segments.
• Review admin accounts and credentials for signs of compromise, and enforce MFA where supported.
• Follow CISA BOD 22-01 guidance or discontinue use of the product if mitigations are unavailable.

Detection

• Monitor SimpleHelp server logs and file system for unexpected file writes outside intended upload directories, especially paths containing traversal sequences.
• Alert on zip file uploads by admin accounts followed by creation or modification of executable files.
• Hunt for new or modified processes spawned by the SimpleHelp server user account.
• Review network and host telemetry for post-exploitation activity tied to Storm-1175/Medusa ransomware indicators referenced in vendor and government reporting.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.