VULNERABILITY INTELLIGENCE

CVE-2024-55956

CVSS score9.8 CRITICAL

EPSS probability93.97%

CISA KEVKnown exploited vulnerability

Published2024-12-13

Last modified2026-08-05

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Cleo Multiple Products Unauthenticated File Upload Vulnerability

Vendor / product: Cleo / Multiple Products

Description

In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.

Weakness classification

nvd@nist.gov: CWE-77
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-77

Primary references

cve@mitre.org — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource