CVE-2024-55956: Cleo Harmony, VLTrader and LexiCom unauthenticated command injection via Autorun

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a 9.8 CVSS score, active exploitation, KEV listing and known ransomware use.

What it is

Cleo Harmony, VLTrader and LexiCom before 5.8.0.24 allow an unauthenticated user to import and execute arbitrary Bash or PowerShell commands on the host by abusing default Autorun directory settings. The flaw is a command injection (CWE-77) reachable over the network with no credentials or user interaction, and it has been exploited in the wild.

Impact

An attacker gains remote code execution on the host with the privileges of the Cleo service, enabling full compromise of the managed file transfer server and any data or credentials it handles.

Attack surface

Reachable over the network via the Autorun import path with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Listed in CISA KEV (added 2024-12-17, due 2025-01-07) with known ransomware campaign use, and EPSS 30-day probability is 0.94037 (99.8th percentile); a third-party advisory is tagged Exploit.

What to do

• Upgrade Cleo Harmony, VLTrader and LexiCom to 5.8.0.24 or later immediately.
• If patching is not possible, follow the vendor advisory mitigations or discontinue use of the product per CISA KEV guidance.
• Restrict network access to the Cleo services to trusted sources only.
• Review and harden Autorun directory configuration and permissions.
• Treat any internet-exposed Cleo instance as potentially compromised and hunt for prior exploitation.

Detection

• Monitor for unexpected Bash or PowerShell process execution spawned by Cleo service processes.
• Audit Autorun directory contents and file writes for unauthorized or suspicious files.
• Review Cleo application and host logs for anomalous import or command activity around the exploitation window.
• Search for outbound connections or dropped tooling consistent with post-exploitation and ransomware staging.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.