Cleo · Multiple Products

CVE-2024-55956

Cleo Multiple Products Unauthenticated File Upload Vulnerability

Exploited in attacks Used by ransomware Critical 9.8 Attack chance: 94%

What it is

In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.

CISA: Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: January 7, 2025

Added to the CISA list: December 17, 2024
Published: December 13, 2024
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 94% in the top 0.2% of all known vulnerabilities
Weakness: CWE-276
More details: NVD · CVE.org · CISA

All references (1)

https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending

More exploited flaws from Cleo

Added	Vulnerability	Product	Severity	Attack chance
Dec 13, 2024	Unrestricted File UploadCVE-2024-50623used by ransomware	Multiple Products	Critical 9.8	99%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.