CVE-2024-57728

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

SimpleHelp remote support software versions 5.5.7 and earlier contain a zip-slip vulnerability that permits authenticated administrators to upload a specially crafted archive and write arbitrary files to any location on the underlying file system. The flaw is tracked as CVE-2024-57728, carries a CVSS 3.1 score of 7.2, and maps to CWE-59 and CWE-22 path-traversal weaknesses; successful exploitation grants the attacker the ability to place executable content that runs in the context of the SimpleHelp server process.

An administrator account is sufficient to trigger the issue over the network. By supplying a malicious zip during the normal file-upload workflow, an attacker can overwrite binaries, scripts, or configuration files used by the SimpleHelp service, ultimately achieving remote code execution on the host without further user interaction.

Vendor guidance published in January 2025 directs administrators to apply the fixes released in SimpleHelp 5.5.8 or later. The vulnerability appears in the CISA Known Exploited Vulnerabilities catalog, and reporting from Microsoft and Trend Micro links exploitation activity to ransomware operators including Storm-1175 and DragonForce campaigns, indicating active in-the-wild use after disclosure. The associated EPSS score has remained elevated, with a recorded peak of 0.5933.