PT-2024-9584 · Cleo · Cleo Harmony+2

Published 2024-12-13 · Updated 2026-02-10 · CVE-2024-55956

Positive Technologies · (AI Summary)

CVSS v2.0

10

Critical

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cleo Harmony versions prior to 5.8.0.24 Cleo VLTrader versions prior to 5.8.0.24 Cleo LexiCom versions prior to 5.8.0.24

Description The issue allows an unauthenticated user to import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory. It is reported that 70% of Cleo File Transfer Exposures may be vulnerable to unauthenticated Remote Code Execution (RCE), and 60% of public servers remain unpatched. The Cl0p ransomware group has taken credit for the exploitation of this issue.

Recommendations For Cleo Harmony versions prior to 5.8.0.24, upgrade to version 5.8.0.24 or later. For Cleo VLTrader versions prior to 5.8.0.24, upgrade to version 5.8.0.24 or later. For Cleo LexiCom versions prior to 5.8.0.24, upgrade to version 5.8.0.24 or later. As a temporary workaround, consider restricting access to the Autorun directory to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Incorrect Default Permissions

Weakness Enumeration

CWE-77

CWE-276

Related Identifiers

BDU:2024-11291

CVE-2024-55956

Affected Products

Cleo Harmony

Cleo Lexicom

Cleo Vltrader

References · 67

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cleo_rce_cve_2024_55956.rb · Exploit
• 🔥 https://huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild · Exploit
• https://osv.dev/vulnerability/CVE-2024-55956 · Vendor Advisory
• https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending · Vendor Advisory
• https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update-CVE-2024-55956 · Security Note
• https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55956 · Security Note
• https://bdu.fstec.ru/vul/2024-11291 · Security Note
• https://twitter.com/MsftSecIntel/status/1881751622138597491 · Twitter Post
• https://twitter.com/touko_oto/status/1869532454043943390 · Twitter Post
• https://twitter.com/CVEnew/status/1868033930361966999 · Twitter Post
• https://twitter.com/TrellixARC/status/1869834256492703908 · Twitter Post
• https://twitter.com/DMFezzaReed/status/1869051629992886462 · Twitter Post
• https://twitter.com/ElusivePrivacy/status/1902364436620284154 · Twitter Post
• https://twitter.com/CISACyber/status/1869051260281708593 · Twitter Post