Threat Intelligence / CVE / CVE-2024-57728

CVE-2024-57728 — Simple-help Simplehelp

CVSS v3.1 7.2 (HIGH) · EPSS 1.0% (higher than 77.3% of all scored CVEs) · Priority 6.7/10 · Published 2025-01-15

As of 2025-01-31, CVE-2024-57728 is a HIGH-severity vulnerability in Simple-help Simplehelp, CVSS v3.1 7.2, EPSS 1.0% (77.3th percentile). Threadlinqs Intelligence links 2 tracked threat campaigns to CVE-2024-57728, most recently “Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign (CVE-2026-23760, CVE-2025-10035)”.

Last updated: 2025-01-31

What is CVE-2024-57728?

SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.

The record classifies CVE-2024-57728 under weakness classes CWE-59, CWE-22. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs high-privilege credentials, needs no user interaction, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 606 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 7.2 — HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS (FIRST): 1.0% probability of exploitation in the next 30 days, higher than 77.3% of all scored CVEs
CISA KEV: Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority: 6.7/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published: 2025-01-15, last modified 2025-01-31

Is CVE-2024-57728 being exploited?

It currently carries a trending score of 24 in the Threadlinqs vulnerability feed.

Affected products and versions

Simple-help: Simplehelp

How to fix CVE-2024-57728

Vendor advisory: https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.

Threat activity tracking CVE-2024-57728

2 tracked threats in the Threadlinqs corpus reference CVE-2024-57728, either in the campaign’s CVE list or as an indicator on the campaign record.

Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign (CVE-2026-23760, CVE-2025-10035) — CRITICAL · 2026-04-06
DragonForce: White-Label Ransomware Cartel — Scattered Spider Partnership & MSP Supply Chain Attacks — HIGH · 2026-02-12

Sources

Seeded from nvd and not yet processed by the Threadlinqs enrichment pipeline, so blank CVSS, EPSS or KEV fields above mean NOT MEASURED rather than measured-absent.

Full detection coverage & IOCs for threats exploiting CVE-2024-57728 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence