CVE-2024-57728: SimpleHelp Path Traversal RCE (KEV, Ransomware Use)

CVE-2024-57728 is a zip-slip path traversal vulnerability in SimpleHelp remote support software that lets an authenticated admin user upload a crafted zip file to write arbitrary files anywhere on the file system, which can be exploited to execute code as the SimpleHelp server user; it has been actively exploited by Medusa and DragonForce ransomware affiliates against SimpleHelp-dependent managed service providers.

CVE-2024-57728 is a path traversal vulnerability (CWE-22, zip-slip pattern) in SimpleHelp remote support software versions 5.5.7 and earlier. NVD's description states it "allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip)" and that "this can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user" (NVD).

NVD's own Primary CVSS v3.1 score is 7.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, high privileges required (admin), no user interaction, full impact to confidentiality, integrity and availability; a CNA-submitted Secondary score agrees exactly at 7.2 (NVD).

SimpleHelp's own knowledge-base advisory confirms versions 5.5.7 and all earlier releases are vulnerable, alongside two related CVEs disclosed in the same advisory (CVE-2024-57726, missing authorization in API-key creation; CVE-2024-57727, an unauthenticated information-disclosure issue). The vendor shipped fixes in 5.5.8, with backported patches for the 5.4.10 and 5.3.9 branches, and recommends operators change the SimpleHelp administrator password, restrict technician login by IP, prefer third-party authentication (e.g. Active Directory) over local technician accounts, scope API tokens to specific IP ranges, and enable server event alerts for administrative access (SimpleHelp KB — Security Vulnerabilities 01/2025).

This vulnerability has been tied to real ransomware intrusions: Microsoft's security blog documents the threat actor tracked as Storm-1175 exploiting vulnerable, internet-facing SimpleHelp instances as an initial-access vector in high-tempo Medusa ransomware operations, and Trend Micro's ransomware-spotlight research separately documents DragonForce affiliates exploiting SimpleHelp flaws to reach managed-service-provider customer environments (Microsoft Security Blog — Storm-1175; Trend Micro — DragonForce Ransomware Spotlight).

CISA added CVE-2024-57728 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-04-24, with a required-action due date of 2026-05-08, and records known ransomware campaign use as "Known" (catalog confirmed live this run, matched by exact cveID string against the raw KEV feed) (CISA KEV).

As of 2026-10-31, FIRST scores the probability of exploitation at 0.6447 (99.24th percentile) — high for a privileged-attacker flaw, consistent with its documented use as a ransomware initial-access vector against remote-support software exposed to the internet (FIRST EPSS).

Given confirmed use by at least two ransomware affiliate groups, any internet-facing SimpleHelp server on a version prior to 5.5.8 (or the 5.4.10/5.3.9 patch branches) should be upgraded immediately, with administrator credentials rotated and technician access restricted by IP as a defense-in-depth measure.

• Zip-slip path traversal lets an authenticated admin user upload a crafted zip file to write arbitrary files anywhere on the file system, exploitable to execute arbitrary code as the SimpleHelp server user. — NVD
• NVD Primary CVSS v3.1 score is 7.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, matching the CNA Secondary submission. — NVD
• Affects SimpleHelp 5.5.7 and earlier; fixed in 5.5.8 with backports to 5.4.10 and 5.3.9; vendor recommends password rotation, IP-restricted technician logins, third-party auth, scoped API tokens and access alerting. — SimpleHelp KB — Security Vulnerabilities 01/2025
• Exploited by the Storm-1175 threat actor as an initial-access vector in high-tempo Medusa ransomware operations against vulnerable internet-facing SimpleHelp instances. — Microsoft Security Blog — Storm-1175
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-04-24, due date 2026-05-08, with known ransomware campaign use recorded as Known. Confirmed present in the live KEV feed by exact cveID match this run. — CISA KEV
• EPSS score is 0.6447 (99.24th percentile) as of 2026-10-31. — FIRST EPSS