In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.

CVE assigned for a zero-day vulnerability in Cleo file transfer tools exploited in ransomware attacks. Patching strongly advised.

Cleo Harmony prior to 5.8.0.24, VLTrader prior to 5.8.0.24 and LexiCom prior to 5.8.0.24 are affected by a vulnerability allowing an unauthenticated attacker to upload an arbitrary file that could lead to remote code execution.

The version of Cleo LexiCom running on the remote host is prior to 5.8.0.24. It is, therefore, affected by an unauthenticated arbitrary command execution vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Cleo Harmony running on the remote host is prior to 5.8.0.24. It is, therefore, affected by an unauthenticated arbitrary command execution vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Cleo VLTrader running on the remote host is prior to 5.8.0.24. It is, therefore, affected by an unauthenticated arbitrary command execution vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
114544	Cleo < 5.8.0.24 Unrestricted File Upload	Web App Scanning	Component Vulnerability	Check Based	critical
213087	Cleo LexiCom < 5.8.0.24 Unauthenticated Arbitrary Command Execution (CVE-2024-55956)	Nessus	CGI abuses	Remote	critical
213086	Cleo Harmony < 5.8.0.24 Unauthenticated Arbitrary Command Execution (CVE-2024-55956)	Nessus	CGI abuses	Remote	critical
213085	Cleo VLTrader < 5.8.0.24 Unauthenticated Arbitrary Command Execution (CVE-2024-55956)	Nessus	CGI abuses	Remote	critical

Detections

Analytics

CVE-2024-55956

critical

Tenable Plugins

critical

critical

critical

critical