Cleo Harmony, VLTrader, and LexiCom Unauthenticated Remote Code Execution (RCE) Vulnerability Advisory (CVE-2024-55956)
Executive & SecOps Summary
SECOPS ASSESSMENTCleo Harmony, VLTrader, and LexiCom versions prior to 5.8.0.24
Unauthenticated remote attackers can leverage default settings of the Autorun directory to import and execute arbitrary Bash or PowerShell commands on the host system, leading to full system compromise.
Immediately upgrade to the patched version (5.8.0.24 or higher) and restrict access to exposed management interfaces.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Administrators must immediately upgrade Cleo installations to version 5.8.0.24 or later by following the official vendor upgrade procedures.
Example commands to stop services and apply the update on Linux:
# Stop the Cleo Harmony service
sudo systemctl stop cleo-harmony.service
# Extract the patch/upgrade package over the installation directory
tar -zxvf cleo-upgrade-5.8.0.24.tar.gz -C /opt/cleo/
# Restart the service and verify status
sudo systemctl start cleo-harmony.service
sudo systemctl status cleo-harmony.service2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict network access to the Cleo administrative and file transfer ports using firewalls or WAFs, limiting access only to trusted IP addresses. Additionally, temporarily revoke write permissions on the Autorun directory.
Revoking write permissions on Linux:
# Remove write permissions from the autorun directories to prevent file creation
chmod 550 /opt/cleo/Harmony/autorun
chmod 550 /opt/cleo/VLTrader/autorun3. Log Audit & IoC Verification Commands
Inspect the Autorun directories for any unauthorized or suspicious script files that may have been uploaded.
PowerShell script to audit the Autorun directory on Windows hosts:
# Audit the default Cleo Autorun directory for recently created script files
$autorunPath = 'C:\Program Files\Cleo\Harmony\autorun'
if (Test-Path $autorunPath) {
Get-ChildItem -Path $autorunPath -Recurse -Include *.ps1, *.bat, *.vbs, *.sh |
Select-Object FullName, CreationTime, LastWriteTime |
Format-Table -AutoSize
} else {
Write-Host 'Autorun directory not found in default path.' -ForegroundColor Yellow
}Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2024-55956) is a critical Command Injection (CWE-77) vulnerability residing in the default configuration of the Autorun directory within Cleo Harmony, VLTrader, and LexiCom. A design flaw in how the application monitors and processes files placed in the designated 'Autorun' directory allows unauthenticated users to introduce and trigger arbitrary system commands without requiring valid credentials.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated remote attacker can exploit this vulnerability by identifying exposed file transfer or administrative endpoints associated with the Cleo software. By leveraging the default insecure settings of the Autorun directory, the attacker uploads or writes malicious script files (such as .sh for Linux or .ps1/.bat for Windows) into this directory. The application's background monitoring service automatically detects the newly added files and executes them with the privileges of the host operating system, resulting in arbitrary code execution.
3. Infrastructure & Business Impact
With a CVSS score of 9.8, this vulnerability poses an extreme risk and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog due to active exploitation in the wild. Successful exploitation allows attackers to gain complete control over the host system, potentially leading to data exfiltration of sensitive managed file transfers, lateral movement within the corporate network, and deployment of ransomware.
Official Vendor Advisories & References
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
Frequently Asked SecOps Questions (CVE-2024-55956)
FAQQ1. How critical is CVE-2024-55956 and is it actively exploited in the wild?
CVE-2024-55956 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 94.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-55956?
Primary impacted vendors include cleo across harmony, vltrader, lexicom. Scope summary: All versions of Cleo Harmony, VLTrader, and LexiCom prior to 5.8.0.24 (both Windows and Linux deployments)
Q3. What temporary mitigations or workarounds exist for CVE-2024-55956 before patching?
[Mitigation] Immediately upgrade to the patched version (5.8.0.24 or higher) and restrict access to exposed management interfaces. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-55956
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (cleo)
View Category →Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
LiteLLM Proxy Server MCP Test Endpoints Remote Code Execution Vulnerability Advisory (CVE-2026-42271)
[Affected Scope] LiteLLM proxy server environments running versions 1.74.2 to before 1.83.7
VMware Aria Operations Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-22719)
[Affected Scope] VMware Aria Operations instances with support-assisted product migration in progress
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.