KEV Alert: SimpleHelp RCE, Samsung, and D-Link Router Flaws

Just catching up on the Friday KEV update from CISA. They added four vulnerabilities, with the standout being CVE-2024-57726 (CVSS 9.9) affecting SimpleHelp remote support software. It’s a missing authorization vulnerability that allows for RCE—bad news if you use this for remote access.

Also on the list are vulnerabilities in Samsung MagicINFO 9 Server and D-Link DIR-823X routers.

While FCEB agencies have until May 2026 to patch, let's be real: if it's a 9.9 and exploited in the wild, we can't wait two years.

For those scanning their environment, I recommend checking your asset inventory for the specific D-Link model strings and verifying the SimpleHelp version.

Here’s a quick PowerShell snippet to help locate vulnerable SimpleHelp versions if the MSI installer metadata is available:

Get-CimInstance -ClassName Win32_Product | Where-Object {
    $_.Name -like "*SimpleHelp*" -and
    $_.Version -lt "5.6.0" # Check specific vulnerable version ranges per vendor advisory
} | Select-Object Name, Version, InstallDate

Network-wise, keep an eye on outbound traffic from unusual processes if these tools are compromised.

Anyone else seeing SimpleHelp targeted in the wild recently? How are you handling remote access tool security given the rise in these specific exploits?