Secuno
ENNL
Book demo

CVE-2024-55956

Cleo Multiple Products Unauthenticated File Upload

9.8 CRITICALActively exploited (CISA KEV)Used in ransomwarePublic exploitEPSS 94.0%
  1. Published13 Dec 2024
  2. Added to CISA KEV17 Dec 2024
  3. Remediation due7 Jan 2025
Actively exploited (CISA KEV)

Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.

Added to KEV: 17 Dec 2024Federal remediation due: 7 Jan 2025Used in ransomware

Description

In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Cleo Harmony< 5.8.0.24
Cleo Lexicom< 5.8.0.24
Cleo Vltrader< 5.8.0.24

Remediation

Fixed in
Cleo Harmony≥ 5.8.0.24
Cleo Lexicom≥ 5.8.0.24
Cleo Vltrader≥ 5.8.0.24

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-10911010.0
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function…
CVE-2026-1091089.9
A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This…
CVE-2026-10891810.0
A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown…
CVE-2026-10891710.0
A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some…
CVE-2026-1089168.3
A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown…
CVE-2026-1088969.9
A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function…

Frequently asked

Is CVE-2024-55956 being actively exploited?

Yes. CVE-2024-55956 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 17 Dec 2024. It has been used in ransomware campaigns.

How severe is CVE-2024-55956?

CVE-2024-55956 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 94.0% probability of exploitation.

Which products are affected by CVE-2024-55956?

Affected products include Cleo Harmony, Cleo Lexicom, Cleo Vltrader.

How do I fix CVE-2024-55956?

Upgrade affected software to a fixed version, for example Cleo Harmony 5.8.0.24, Cleo Lexicom 5.8.0.24, Cleo Vltrader 5.8.0.24 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-55956 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.