Critical severity · published Dec 13, 2024
CVE-2024-55956
Cleo Multiple Products Unauthenticated File Upload Vulnerability
RansomwareIn wildKEV
9.8
CVSS
94%
EPSS
Yes
On KEV
Description
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)94.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Dec 17, 2024
Federal remediation dueJan 7, 2025
Ransomware campaign useKnown
Affected products
Which versions
HA
Harmony · Cleo
before 5.8.0.24 · source: NVD
MP
Multiple Products · Cleo
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-55956
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-55956
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
support.cleo.com
https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending
More from Harmony
9.8
CVE-2024-50623
Cleo Multiple Products Unrestricted File Upload Vulnerability
9.8
CVE-2021-33576
An issue was discovered in Cleo LexiCom 5.5.0.0
8.3
CVE-2026-84115
Cleo Harmony JWT Refresh Token connections privileges management
6.3
CVE-2026-84114
Cleo Harmony SAML Authentication LocalUserUtil.getNativeUserByAssertions improper authentication
5.3
CVE-2021-33577
An issue was discovered in Cleo LexiCom 5.5.0.0