Summary
SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords.
- Vendor
- SimpleHelp
- Product
- SimpleHelp
- Added to KEV
- Feb 13, 2025
- Remediation due
- Mar 6, 2025 (US federal deadline)
- Ransomware use
- Known
- Weakness
- CWE-22
- EPSS
- 96.8% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References