{"id":"CVE-2024-55956","published":"2024-12-13T21:15:13Z","modified":"2026-08-05T05:16:42Z","title":"Cleo Multiple Products Unauthenticated File Upload Vulnerability","vendor":"Cleo","product":"Multiple Products","tier":"core","eol":null,"description":{"text":"In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.","provenance":"source","from":"NVD"},"summary":{"text":"The vulnerability lies in Cleo Harmony, VLTrader, and LexiCom before version 5.8.0.24, where the default settings of the Autorun directory allow file import. An unauthenticated remote attacker, with no user interaction required, can import and execute arbitrary Bash or PowerShell commands on the host system using these default configurations.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:21Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.93968,"percentile":0.99845,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-12-17","dueDate":"2025-01-07","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update-CVE-2024-55956 ; https://nvd.nist.gov/vuln/detail/CVE-2024-55956","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-12-10","exploitedFirstSeen":"2024-12-10","ransomware":true,"evidence":[{"url":"https://cyberplace.social/@GossiTheDog/113628339890303857","date":"2024-12-10"},{"url":"https://www.rapid7.com/blog/post/2024/12/10/etr-widespread-exploitation-of-cleo-file-transfer-software-cve-2024-50623/","date":"2024-12-10"},{"url":"https://threats.wiz.io/all-incidents/cleo-vulnerabilities-targeted-by-cl0p-ransomware","date":"2024-12-15"},{"url":"https://www.bleepingcomputer.com/news/security/clop-ransomware-claims-responsibility-for-cleo-data-theft-attacks/","date":"2024-12-16"},{"url":"https://censys.com/advisory/cve-2024-55956","date":"2024-12-17"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-12-17"},{"url":"https://www.threatdown.com/blog/cleo-the-next-moveit-and-goanywhere/","date":"2024-12-17"},{"url":"https://censys.com/cve-2024-55956/","date":"2024-12-18"},{"url":"https://www.guidepointsecurity.com/wp-content/uploads/2021/07/GRIT_2025_Ransomware_and_Cyber_Threat_Report.pdf","date":"2025-01-16"},{"url":"https://www.recordedfuture.com/blog/cleo-mft-cve-2024-50623-vulnerability-analysis","date":"2025-01-21"}],"evidenceTotal":43,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"},{"id":"CWE-276","name":"Incorrect Default Permissions"}],"references":[{"url":"https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending","tags":["Vendor Advisory"]},{"url":"https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update","tags":["Vendor Advisory"]},{"url":"https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55956","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated remote exploitation of exposed application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"an unauthenticated user can import and execute arbitrary Bash or PowerShell commands","start":88,"end":172}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary command execution on host","mappingType":"primary_impact","evidence":[{"from":"description","quote":"can import and execute arbitrary Bash or PowerShell commands on the host system","start":112,"end":191}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-3cdab069b9896987972b","title":"LightSpy Malware Variant Targeting macOS","publisher":"huntress.com","url":"https://www.huntress.com/blog/lightspy-malware-variant-targeting-macos","date":null,"mentions":[{"quote":"Malichus Implant Malware AnalysisTeam Huntress has analyzed Cleo's software vulnerability CVE-2024-55956.","start":9536,"end":9641}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-52864","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-52864","exploited":true,"exploitedSince":"2024-12-17","provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"Cleo LexiCom, VLTrader, and Harmony Unauthenticated Remote Code Execution","module":"exploit/multi/http/cleo_rce_cve_2024_55956","type":"exploit","disclosureDate":"2024-12-09","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cleo_rce_cve_2024_55956.rb"}],"nuclei":[{"id":"CVE-2024-55956","name":"Cleo Harmony < 5.8.0.24 - File Upload Vulnerability","severity":"critical","path":"http/cves/2024/CVE-2024-55956.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55956.yaml"}],"first":{"date":"2024-12-09","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cleo_rce_cve_2024_55956.rb"},"provenance":"source"},"exploitRefs":["https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2024-12-09","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cleo_rce_cve_2024_55956.rb","provenance":"source"},{"date":"2024-12-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cyberplace.social/@GossiTheDog/113628339890303857","provenance":"source"},{"date":"2024-12-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55956","provenance":"source"},{"date":"2024-12-17","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-12-17","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-52864","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":4},"priority":{"score":83.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 689 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9984"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}