SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a
Affects SimpleHelp remote support software 5.5.7 and earlier, where the risk depends on an attacker logging in as the SimpleHelpAdmin user or as a technician with admin privileges. Fixed in 5.5.8.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 5.5.8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
SimpleHelp, a remote support software product, is affected by this vulnerability. An administrator with access can exploit it to write files anywhere on the server and run arbitrary code with the privileges of the SimpleHelp server user.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a n/a
Version range not reported
References 2
Questions about CVE-2024-57728
What does this mean?
A user with admin access to SimpleHelp can upload files to any location on the server host, for example a crontab file, which can be used to run remote commands.Source: guides.simple-help.com, horizon3.ai
Am I affected, and how do I check?
SimpleHelp versions 5.5.7 and all earlier releases are affected. The issue applies when an attacker can log in as the SimpleHelpAdmin user or as a technician with admin privileges, so check your installed SimpleHelp version against 5.5.7.Source: guides.simple-help.com, horizon3.ai
What should I do about it?
Upgrade to SimpleHelp 5.5.8 or a later version, which the vendor says resolves these vulnerabilities.Source: guides.simple-help.com, horizon3.ai
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-04-24, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data