CVE-2024-57726

Published Jan 15, 2025

Last updated 14 days ago

API

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-57726 is a vulnerability found in SimpleHelp remote support software, affecting versions 5.5.7 and earlier. This flaw permits technicians with low-level privileges to generate API keys that possess excessive permissions. These overly permissive API keys can then be leveraged by the technician to escalate their privileges, ultimately gaining server administrator access within the SimpleHelp environment. This vulnerability is classified under CWE-862, indicating a lack of access control.

Description: SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
Source: cve@mitre.org
NVD status: Analyzed
Products: simplehelp

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.9
Impact score: 6
Exploitability score: 3.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: SimpleHelp Missing Authorization Vulnerability
Exploit added on: Apr 24, 2026
Exploit action due: May 8, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-862

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:simple-help:simplehelp:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "B51B617B-82A8-4B34-BE2E-2D3C9CDE6D12",
            "versionEndExcluding": "5.5.8",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.