CVE-2024-55956 Cleo Multiple Products Unauthenticated File Upload
Unauthenticated attackers can execute arbitrary commands on Cleo Harmony, VLTrader, and LexiCom servers via the Autorun directory.
- Exploited in the wild
- Since 17 Dec 2024
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-55956?
CVE-2024-55956 is a critical command injection vulnerability in n/a, published on 13 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
Weakness: CWE-77
Which versions are affected by CVE-2024-55956?
It affects 3 products.
Products include Cleo Harmony, Cleo Lexicom, Cleo Vltrader.
How do I fix CVE-2024-55956?
No fix has been published for CVE-2024-55956 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 7 Jan 2025.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-55956 being exploited?
Yes. Attackers have exploited CVE-2024-55956 in the wild since at least 17 Dec 2024, including in ransomware campaigns.
Public exploit code: 1 Metasploit module and 1 Nuclei template.
Other vulnerabilities in n/a
Sources
Also known as CVE-2024-12632, GHSA-v87c-pw6c-99w6.