CVE-2024-57726

What is SimpleHelp?

SimpleHelp is a commercial Remote Monitoring and Management (RMM) and remote support software platform deployed across thousands of organizations globally since 2007. It provides cross-platform remote desktop control, unattended access, file transfer, automation scripting, and live monitoring — all run on-premises or in the cloud.

SimpleHelp is disproportionately high-value for attackers because of its MSP customer base. Managed Service Providers use SimpleHelp to manage the IT infrastructure of dozens or hundreds of downstream client organizations. Compromising one MSP's SimpleHelp server cascades directly into all of those clients' networks via trusted, authenticated channels. This is the same reason threat actors target other RMM platforms like ConnectWise ScreenConnect, Kaseya VSA, and SolarWinds.

Overview

CVE-2024-57726 is a missing authorization (CWE-862) flaw in SimpleHelp's API key management system. A low-privilege technician user can create API keys with server administrator permissions — bypassing all role-based access controls — and then use those keys to fully take over the SimpleHelp server.

This vulnerability was discovered and disclosed by the Horizon3.ai Attack Research Team in January 2025 as part of a three-CVE cluster affecting SimpleHelp v5.5.7 and earlier. Within nine days of public disclosure, multiple threat actors were actively exploiting it. The DragonForce ransomware group subsequently weaponized the full vulnerability chain in MSP supply-chain attacks that propagated ransomware to downstream client organizations.

The SimpleHelp Vulnerability Chain

CVE-2024-57726 is part of three closely related flaws discovered and disclosed together by Horizon3.ai:

Full attack chain: An attacker exploits CVE-2024-57727 to read serverconfig.xml (unauthenticated), extracting hashed credentials or API keys. They then use a technician account to exploit CVE-2024-57726 and generate an admin API key. Finally, with admin access, they exploit CVE-2024-57728 to achieve remote code execution on the host.

Affected Versions

Technical Details

The vulnerability is in SimpleHelp's API key creation endpoint. When a technician issues a POST request to /api/admin/keys, the server does not validate that the calling user actually holds the Admin role before processing the request. This missing authorization check allows any authenticated technician to:

1. Send a crafted request to /api/admin/keys specifying server_admin role permissions
2. Receive a valid API key with full admin privileges
3. Use that key to invoke any admin-level API method: enumerate all managed systems, modify server configuration, create new accounts, and more

The Scope: Changed in the CVSS vector (S:C) reflects that a successful exploit does not just compromise the SimpleHelp server — it cascades to all client systems that server manages.

Discovery

Discovered by the Horizon3.ai Attack Research Team after identifying SimpleHelp as widely internet-exposed software with significant MSP market penetration. Horizon3.ai initiated coordinated disclosure on December 30, 2024 and published their full technical analysis alongside SimpleHelp's patches on January 13, 2025.

Exploitation Context

Initial Access Campaigns

Arctic Wolf observed the first exploitation attempts on January 22, 2025 — just nine days after Horizon3.ai's public disclosure. Attack patterns included:

• Unauthorized account enumeration via /api/technicians
• Domain reconnaissance using cmd.exe, net, and nltest commands from within compromised SimpleHelp sessions
• Attempts to establish persistent access before defenders detected the intrusion

DragonForce MSP Supply-Chain Attacks

Sophos documented a coordinated campaign by the DragonForce ransomware-as-a-service group exploiting the SimpleHelp vulnerability chain to attack MSPs and their clients:

• Attackers gained initial access to MSP SimpleHelp servers using the CVE-2024-57726 privilege escalation
• Used SimpleHelp's built-in RMM capabilities to enumerate managed client devices and network topology
• Deployed PDQ Deploy to push ransomware payloads (including Gaze.exe) across client networks
• Installed AnyDesk for persistent interactive C2
• Created local admin accounts (admin) for persistence after SimpleHelp cleanup
• Executed credential harvesting scripts (Get-Veeam-Creds.ps1) to steal backup credentials
• Exfiltrated data before detonating ransomware across multiple client organizations simultaneously

Medusa ransomware operators also leveraged SimpleHelp vulnerabilities in Q1 2025 campaigns, targeting organizations in the UK and causing SYSTEM-level compromise across customer networks.

Exposure

Shadowserver Foundation reported approximately 580+ internet-exposed SimpleHelp instances at peak. NHS England and the Health-ISAC issued specific alerts to healthcare organizations due to targeted attacks on the sector.

Remediation

1. Upgrade SimpleHelp immediately to v5.5.8, v5.4.10, or v5.3.9 depending on your version branch. Patches were released January 8–13, 2025.
2. Audit API keys — review all existing API keys for unauthorized server_admin privileges and revoke any you did not create.
3. Review technician accounts — disable or remove accounts that should not exist; check for newly created admin accounts.
4. Audit managed device access logs within SimpleHelp for unauthorized connections or reconnaissance activity.
5. Restrict internet exposure — SimpleHelp management interfaces should not be directly internet-accessible. Use VPN or firewall restrictions.
6. Review downstream client systems if your SimpleHelp deployment was potentially compromised — treat all managed endpoints as potentially accessed.