CVE-2024-57727: SimpleHelp unauthenticated path traversal, actively exploited
The short version: SimpleHelp remote-support software (v5.5.7 and earlier) has path-traversal flaws (CVE-2024-57727) that let a remote, unauthenticated attacker download arbitrary files from the server — including serverconfig.xml, which holds secrets and hashed user passwords. That leak is the first link in a chain that leads to full server takeover, it's been mass-exploited, and it's in CISA's KEV catalog. Steady hands — but move: upgrade to 5.5.8 and rotate what leaked.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate — an unauthenticated credential leak that seeds a takeover chain (Critical when chained) |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVSS v3.1 (CISA-ADP) | 9.1 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| EPSS | 95.15% · 99.9th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation due 2025-03-06 (added 2025-02-13) |
| Known exploited? | Yes — widely exploited, including in ransomware intrusions |
| Vulnerability type | CWE-22 path traversal → unauthenticated download of arbitrary server files (secrets, hashed passwords) |
| Requires authenticated session? | No — pre-authentication |
| Affected | SimpleHelp 5.5.7 and earlier |
| Fixed in | 5.5.8 |
What you need to know
SimpleHelp is remote-support software — by design it reaches onto the machines it supports, which makes its own server a high-value target. This flaw lets an unauthenticated attacker walk outside the intended directory with crafted requests (for example, traversal sequences resolving to configuration/serverconfig.xml) and pull back server files they should never see.
The prize is that configuration file: it contains secrets and hashed user passwords. With those in hand, an attacker is positioned for the rest of the chain disclosed alongside it — CVE-2024-57726 (privilege escalation to admin) and CVE-2024-57728 (admin file upload → code execution) — turning an unauthenticated file read into full server takeover.
- It's pre-authentication and automatable. No credentials, no user interaction; simple to script and sprayed widely.
- It leaks the keys, not just data. Credential material is what makes this more than an information-disclosure footnote.
- It's the front door of the chain. Attackers, including ransomware crews, used it as step one.
How serious we see it
Moderate on its own — and Critical as it's actually used.
Mechanically this is an information-disclosure bug, which is why NVD lands at 7.5. But when the information disclosed is secrets and hashed passwords for a remote-support server, it behaves like the opening move of an authentication bypass — CISA's own analysts score it 9.1, and the real-world chain ends in server takeover. We rate by what it leads to. The bounded, reassuring part: a single upgrade to 5.5.8 closes it (and its chain-mates), the affected range is clear, and exposure is quick to confirm.
Recommendations
Straight from the vendor's bulletin and CISA:
- Patch now. Upgrade SimpleHelp to 5.5.8 or later — this also closes CVE-2024-57726 and CVE-2024-57728.
- Rotate everything that leaked. Reset admin/technician credentials and any secrets stored in
serverconfig.xml; assume hashed passwords are recoverable. - Get the server off the open internet. Restrict SimpleHelp access to trusted networks or a VPN.
- Hunt for prior use. Given active exploitation, review logs for traversal requests and follow-on activity, and investigate downstream endpoints the server can reach.
- Confirm your exposure first. Verify whether any SimpleHelp server is internet-facing and which version it runs.
How BreachRisk sees it
BreachRisk discovers internet-facing SimpleHelp servers from little more than your domain, fingerprints the version, and flags exposure tied to this KEV-listed, actively exploited flaw — raised to the top of your results because it's in KEV. Where testing is authorized, BreachRisk can safely confirm whether the traversal actually returns protected server content — a bounded check, not a credential harvest — turning "this looks like an exposed SimpleHelp" into a verified finding.
That outside-in view matters most for the front door of a takeover chain: map and prioritize the exposed server before someone reads its secrets and works the rest of the sequence.