CVE-2024-57726
First published: Wed Jan 15 2025(Updated: )
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SimpleHelp | <5.5.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/
- https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier
- https://www.bleepingcomputer.com/news/security/hackers-exploiting-flaws-in-simplehelp-rmm-to-breach-networks/
- https://www.bleepingcomputer.com/news/security/simplehelp-rmm-flaws-exploited-to-breach-corporate-networks/
- https://www.bleepingcomputer.com/news/security/hackers-exploit-simplehelp-rmm-flaws-to-deploy-sliver-malware/
Frequently Asked Questions
What is the severity of CVE-2024-57726?
CVE-2024-57726 is a high-severity vulnerability that allows unauthorized API key creation, enabling privilege escalation.
How do I fix CVE-2024-57726?
To fix CVE-2024-57726, upgrade SimpleHelp to version 5.5.8 or later to eliminate the excessive permissions for API keys.
Who is affected by CVE-2024-57726?
CVE-2024-57726 affects all versions of SimpleHelp remote support software up to and including v5.5.7.
What can attackers do with the CVE-2024-57726 vulnerability?
Attackers can exploit CVE-2024-57726 to create API keys that grant them unauthorized access and potentially elevate their privileges to server admin.
What is SimpleHelp and its relation to CVE-2024-57726?
SimpleHelp is remote support software, and CVE-2024-57726 identifies a security flaw in it that allows for privilege escalation through API keys.
- collector/mitre-cve
- source/MITRE
- agent/description
- agent/first-publish-date
- agent/type
- agent/author
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2024-57726
- alias/CVE-2024-57727
- alias/CVE-2024-57728
- agent/source
- agent/last-modified-date
- agent/weakness
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- agent/software-canonical-lookup
- agent/news-ai
- exploited/true
- agent/severity
- agent/references
- agent/tags
- agent/event
- agent/trending
- vendor/simple-help
- canonical/simplehelp