CVE-2024-57726: 
SimpleHelp vulnerability analysis and mitigation

SimpleHelp remote support software v5.5.7 and earlier contains a critical privilege escalation vulnerability (CVE-2024-57726) that allows low-privilege technicians to create API keys with excessive permissions, which can be used to escalate privileges to the server admin role. The vulnerability was discovered in January 2025 and affects all SimpleHelp versions up to and including v5.5.7. The issue was patched in versions 5.5.8, 5.4.10, and 5.3.9 (SimpleHelp KB, Horizon3).

The vulnerability has been assigned a CVSS v3.1 base score of 9.9 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The flaw stems from missing backend authorization checks that allow technicians to promote themselves to admin privileges through a crafted sequence of network calls. Once elevated to admin, attackers can exploit additional vulnerabilities like arbitrary file upload to gain complete control of the SimpleHelp server (NVD, Horizon3).

If successfully exploited, this vulnerability allows attackers to gain full administrative access to the SimpleHelp server and potentially compromise all connected client machines. Administrators can interact with any connected customer machines or access customer machines directly if unattended access is configured. The vulnerability's scope change means that an elevated admin user can potentially access connected client machines that the original low-privilege technician did not have access to (Horizon3).

Organizations are strongly advised to upgrade to SimpleHelp version 5.5.8 or apply the available patches (5.4.10 or 5.3.9). Additional recommended mitigations include: changing the administrator password of the SimpleHelp server, rotating passwords for Technician accounts, and restricting IP addresses from which the SimpleHelp server can accept Technician and administrator logins. For organizations where SimpleHelp client was previously installed for third-party support sessions but isn't actively used, uninstallation is recommended to reduce the attack surface (SimpleHelp KB, Arctic Wolf).