CVE-2024-57728KEV · OVERDUE

SimpleHelp Path Traversal Vulnerability

High · published January 15, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.2. It is confirmed in active exploitation. It sits in the 99.2th percentile for exploit probability.

168
days past CISA
deadline
CVSS v3.1
7.2
EPSS
64%
Percentile
99.2
In the wild
Confirmed
What it is

SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.64468 · 99.2th percentile
Published
2025-01-15T00:00Z
KEV added
2026-04-24 · due 2026-05-08
EPSS history
Timeline
  • 27 SEP 03:18Z
    EPSS moved 7% → 65%
    epss
  • 26 SEP 03:19Z
    EPSS moved 7% → 65%
    epss
  • 24 APR 00:00Z
    Added to CISA KEV — remediate by May 8
    kev
  • 15 JAN 00:00Z
    SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file…
    cvelistv5