Cyber Posture

CVE-2024-57728

HighCISA KEVActive Exploitation

Published: 15 January 2025

Published
15 January 2025
Modified
24 April 2026
KEV Added
24 April 2026
Patch
—
CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.5933 98.3th percentile
Risk Priority 70 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting.

Security Summary

CVE-2024-57728 affects SimpleHelp remote support software versions 5.5.7 and earlier. The vulnerability is a zip slip flaw (CWE-59, CWE-22) that allows authenticated admin users to upload crafted zip files, enabling arbitrary file writes anywhere on the file system. This can lead to arbitrary code execution on the host in the context of the SimpleHelp server user. Published on 2025-01-15, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H).

An attacker with admin privileges can exploit this over the network with low complexity and no user interaction required. By uploading a malicious zip file, they achieve remote code execution as the server process user, potentially compromising the host through file overwrites in critical paths like executables or configuration files.

Advisories reference mitigations including a vendor knowledge base article on vulnerabilities in SimpleHelp 5.5.7 and earlier (simple-help.com), a Horizon3.ai disclosure on critical issues, and CISA's Known Exploited Vulnerabilities catalog entry.

The vulnerability is listed in CISA's KEV catalog, signaling real-world exploitation. References link it to ransomware activity, including Storm-1175 operations targeting web-facing assets in Medusa ransomware campaigns (Microsoft) and DragonForce ransomware (Trend Micro).

Details

CWE(s)
CWE-59CWE-22
KEV Date Added
24 April 2026

Affected Products

simple-help
simplehelp
≤ 5.5.8

MITRE ATT&CK Enterprise Techniques

T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1505 Server Software Component Persistence
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
attack.mitre.org →
T1608.001 Upload Malware Resource Development
Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting.
attack.mitre.org →
Why these techniques?

The zip slip vulnerability enables authenticated admins to upload crafted ZIP files for arbitrary file writes anywhere on the filesystem, leading to RCE in the server context. This facilitates exploitation of public-facing applications/remote services (T1190/T1210), abuse of server software components (T1505), web shell deployment (T1100), and malware upload (T1608.001).

References