CVE-2024-55956
Cleo Multiple Products Unauthenticated File Upload Vulnerability
Published Dec 13, 2024 · updated Aug 4, 2026 · cleo harmony
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
Timeline
Detection, updates, and resolution for this record.
Dec 13, 2024 · Catalog
Detected
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
Dec 17, 2024 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jan 7, 2025 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Aug 4, 2026 · Catalog
Updated
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Jan 7, 2025
Affected
- cpe cleo/harmonyversion unspecified
- cpe cleo/lexicomversion unspecified
- cpe cleo/vltraderversion unspecified
- vendor Cleo Multiple Productsversion unspecified
Sources
- CISA KEVCVE-2024-55956
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
cisa.gov - CVE.orgCVE-2024-55956
Official CVE identifier
cve.org - FIRST EPSSCVE-2024-55956
30-day exploitation probability 94.0%
first.org - Metasploit Modulesexploit_multi/http/cleo_rce_cve_2024_55956
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2024-55956
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
nvd.nist.gov