CVE-2024-57727
SimpleHelp Path Traversal Vulnerability
- Published
- Jan 15, 2025
- Updated
- Aug 4, 2026
- Assigning CNA
- mitre
- Evidence observed
- Feb 13, 2025
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NHigh · next 30 days
- Percentile
- 99.9%
- Model date
- Oct 13, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.
Sources
modules/auxiliary/scanner/http/simplehelp_toolbox_path_traversal.rb
Metasploit Framework modulesDeclared conditions
- verification: check_not_declared($.auxiliary_scanner/http/simplehelp_toolbox_path_traversal.check)
http/cves/2024/CVE-2024-57727.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: word($.matchers[*].type)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.