[HIGH PRIORITY] SimpleHelp Remote Support RCE (CVE-2024-55956)

⚠ HIGH PRIORITY — CISA KEV. CVE-2024-55956 allows unauthenticated remote code execution in SimpleHelp remote support software on Linux and Windows. MSPs and IT teams use SimpleHelp for remote desktop — exploitation grants access to all connected endpoints.

Affected SimpleHelp

• SimpleHelp before 5.5.8
• Self-hosted SimpleHelp on port 443/8080
• MSP remote support gateways

Check version

curl -sk https://support.example:443/ | grep -i simplehelp
systemctl status simplehelp 2>/dev/null

Patching Method

1. Download SimpleHelp 5.5.8+ from vendor portal.
2. Notify users — brief outage during upgrade.
3. On Linux: stop service, backup /opt/simplehelp, run upgrade installer, restart.
4. Verify version in admin console About page.
5. Audit technician accounts for unknown admin users.
6. Invalidate all active remote sessions and regenerate API keys.

systemctl restart simplehelp
grep -i version /opt/simplehelp/config/*.xml 2>/dev/null

Until patched

• Disable internet access to SimpleHelp portal
• Require VPN for all remote support sessions
• Assume breach if exposed unpatched during active exploitation window