--- title: "SimpleHelp CVE-2024-57727: Ransomware Entry via File Read" url: https://erroneo.us/security/briefs/simplehelp-cve-2024-57727-unauthenticated-file-download-kev/ description: "Unauthenticated file download in SimpleHelp 5.5.7 and earlier, used by ransomware crews since January 2025. Fixed in 5.5.8; run 5.5.16+ and rotate secrets." type: security-brief section: "Security Digest" date_published: 2025-01-08 date_modified: 2026-10-23 publisher: erroneo.us author: erroneo.us Security Desk verdict: "Check exposure" cves: ["CVE-2024-57727"] severity: "critical" exploited: "in-the-wild" kev: true license: All rights reserved. Quote with attribution and a link. --- # SimpleHelp CVE-2024-57727: Ransomware Entry via File Read **Verdict: Check exposure.** Patched since January 2025, but this one-request file read was the door several ransomware crews used into MSPs and their customers; any SimpleHelp server that was online below 5.5.8 should be treated as having leaked its config file and secrets, and every server should now be on 5.5.16 or later. - **Who must act:** Anyone who runs a SimpleHelp server, or whose endpoints connect to one run by an MSP or bundled in vendor software, if that server was below 5.5.8 (or an unpatched 5.4.10 or 5.3.9) while reachable from the internet. - **Who can relax:** Teams with no SimpleHelp anywhere, and owners of servers that were patched in January 2025, now run 5.5.16 or later, limit logins to known addresses and show no unknown sessions or tokens. - **Affected:** SimpleHelp 5.5.7 and all earlier releases; SimpleHelp 5.4.10 and 5.3.9 without Patch 070125 - **Fixed:** SimpleHelp 5.5.8 (Jan 8, 2025); Patch 070125 for 5.4.10 (Jan 8) and 5.3.9 (Jan 13, 2025); Recommended now: 5.5.16 or later, which also fixes CVE-2026-48558 - **CVEs:** CVE-2024-57727 - **CISA KEV:** yes · **Exploitation:** Exploited in the wild ## What to do 1. Find every SimpleHelp server you run or depend on, including MSP-hosted and vendor-embedded ones, and check its version at /allversions. 2. Upgrade to 5.5.16 or later; 5.5.8 or Patch 070125 only covers the January 2025 bugs. 3. If a server was internet-facing below 5.5.8, assume serverconfig.xml was stolen: change the SimpleHelpAdmin and technician passwords, recreate API tokens, rotate LDAP bind credentials and OIDC client secrets, and re-enroll MFA. 4. Restrict technician, admin and API logins to approved IP addresses, and disable SimpleHelpAdmin in favor of named accounts. 5. On endpoints, confirm every ConnectTo line in serviceconfig.xml points to a server you own or trust. ### How to check if you are affected - On 5.5.8 and later, '[WebDownloadServer] Insecure request' log entries mean someone probed for this file-read bug. - Review technician logins and the History tab for sessions or source IPs you do not recognize, especially since January 2025. - Search endpoints for three-letter executables such as aaa.exe or bbb.exe created after January 2025, which CISA lists as an indicator. - Look for endpoints registered to an unapproved SimpleHelp server, the first sign Arctic Wolf saw in January 2025. ## What happened SimpleHelp is remote support software that managed service providers (MSPs) and IT teams host themselves. On January 6, 2025, Horizon3.ai reported three flaws to SimpleHelp. The vendor shipped 5.5.8 and a 5.4.10 patch on January 8 and a 5.3.9 patch on January 13. Our companion brief covers the other two, CVE-2024-57726 (technician-to-admin escalation) and CVE-2024-57728 (zip-slip upload). This one, CVE-2024-57727, needs no login at all. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2024-57727) describes path traversals that let an unauthenticated attacker download arbitrary files from the SimpleHelp host with crafted HTTP requests. [Horizon3](https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/) says the key target is `configuration/serverconfig.xml`. It holds hashed passwords for SimpleHelpAdmin and local technicians and, depending on setup, LDAP credentials, OIDC client secrets, API keys and TOTP seeds used for MFA. Those secrets are encrypted with a hardcoded key. Horizon3 called the bugs "trivial to reverse and exploit." Attacks followed within weeks. Roughly a week after Horizon3 went public, Arctic Wolf reported intrusions through SimpleHelp. It linked them to the new flaws with medium confidence, per [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-exploiting-flaws-in-simplehelp-rmm-to-breach-networks/), which also cited 580 vulnerable servers exposed online. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-57727) on February 13, 2025, and marks ransomware use as known. On June 4, 2025, the updated [Play ransomware advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a) said multiple ransomware groups, "including initial access brokers with ties to Play ransomware operators," exploited it at many US entities. On June 12, [AA25-163A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a) said ransomware actors likely used it to reach customers of a utility billing software provider and described a pattern of such attacks since January 2025. ## Who is affected SimpleHelp 5.5.7 and earlier, per the [vendor's notice](https://simple-help.com/kb---security-vulnerabilities-01-2025). 5.4.10 and 5.3.9 are fixed only with Patch 070125. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-57727) scores the bug 7.5 for the file read alone. CISA's enrichment on the CVE record scores it 9.1, rating the integrity impact high as well. ## Do you really need to act? Only if you run or rely on a server that missed the January 2025 patch. Several crews used that window. Upgrading does not change secrets that already leaked, so a server that was exposed while unpatched needs credential rotation and a hunt. Also, 5.5.8 is no longer enough. [CVE-2026-48558](https://www.cve.org/CVERecord?id=CVE-2026-48558), an OIDC login bypass in 5.5.15 and earlier, joined KEV on June 29, 2026. SimpleHelp's [Security Notice 2026-05](https://simple-help.com/security/simplehelp-security-update-2026-05) points 5.5.x users to 5.5.16. ## What to do now 1. Check each server's version with `curl -s https://support.example.com/allversions`, or read the top of `SimpleHelp/configuration/serverconfig.xml`. 2. Upgrade to 5.5.16 or later. 3. For any server exposed below 5.5.8, rotate everything in `serverconfig.xml`: admin and technician passwords, API tokens, LDAP bind accounts, OIDC client secrets and MFA enrollments. 4. Restrict technician, admin and API logins to approved addresses, and disable SimpleHelpAdmin, as the vendor advises. 5. Ask any MSP or software vendor that connects to you over SimpleHelp for its version and patch date. ## How to tell if you were hit On 5.5.8 and later, the vendor says `[WebDownloadServer] Insecure request` log lines mean a client probed for this bug. Run `grep -rF "Insecure request"` over the server's log folder. Review technician logins and the History tab for unknown sessions or source IPs. On endpoints, open `JWrapper-Remote Access/JWAppsSharedConfig/serviceconfig.xml` and check every `