Security readout for executives and security teams
Plain-English summary
This flaw lets an unauthenticated remote attacker make vulnerable Cleo file-transfer software run operating-system commands. Successful compromise could expose transferred data, alter files, disrupt services, and provide control of the host. The CVSS score is 9.8, and CISA lists the vulnerability as known exploited.
Executive priority
Immediate priority. Identify and upgrade affected systems, restrict exposure, and investigate vulnerable or previously exposed hosts for compromise. Because exploitation is documented, upgrading alone does not establish that an earlier intrusion did not occur. Assign coordinated vulnerability-management and incident-response ownership with prompt executive tracking.
Technical view
CVE-2024-55956 is a CWE-77 command-injection vulnerability involving default Autorun directory settings. It affects Cleo Harmony, VLTrader, and LexiCom versions before 5.8.0.24. A network attacker needs no credentials or user interaction to import and execute arbitrary Bash or PowerShell commands with high confidentiality, integrity, and availability impact.
Likely exposure
Exposure exists where Harmony, VLTrader, or LexiCom earlier than 5.8.0.24 is deployed, especially when reachable from untrusted networks. The bundle does not identify affected CPEs, deployment prevalence, or whether particular configurations eliminate exposure, so organizations must verify their own versions and Autorun settings.
Exploitation context
Active exploitation is supported by CISA's Known Exploited Vulnerabilities listing and the cited Huntress threat advisory. The supplied evidence does not quantify affected organizations, attribute every campaign, or establish that exploitation remains limited to any specific sector. Treat exposed vulnerable systems as potential incident-response cases, not merely patching tasks.
Researcher notes
The supplied CVE description establishes unauthenticated network command execution through default Autorun behavior and a 9.8 CVSS v3.1 rating. Product scope is explicit, but structured affected-product data is incomplete and contains no CPEs. Researchers should rely on Cleo guidance for authoritative configuration and remediation details and avoid assuming undocumented version or platform conditions.
Mitigation direction
- Upgrade affected Cleo products to version 5.8.0.24 or later following Cleo's security guidance.
- Restrict untrusted network access to affected file-transfer services until remediation is verified.
- Review Cleo's current advisory for any additional configuration changes or compensating controls.
- Isolate systems showing suspicious activity and begin incident response before returning them to service.
Validation and detection
- Inventory all Harmony, VLTrader, and LexiCom installations and record their exact versions.
- Confirm every affected installation runs version 5.8.0.24 or later.
- Review Autorun activity, imported files, spawned processes, and relevant Bash or PowerShell execution records.
- Check for unexpected accounts, persistence, altered configurations, or outbound connections indicating host compromise.
- Verify network controls prevent unnecessary untrusted access to the Cleo services.
Public sources used
The source record changed after analysis: Material source record changed after analysis.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-77: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-55956 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE publishedCVE Program
The CVE record was published.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2024-55956 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2024-12-17T00:00:00.000Z: CVE-2024-55956 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-PendingCVE reference, mitre
- https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-UpdateCVE reference, CVE
- https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wildCVE reference, CVE
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55956CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in a Command ('Command Injection')
Improper Neutralization of Special Elements used in a Command ('Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.