CVE-2024-55956: Cleo Multiple Products Unauthenticated File Upload Vulnerability
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
Other sources
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cleo Harmonyto a version that resolves this vulnerability.Fixed in 5.8.0.24 - Upgrade
Upgrade
VLTraderto a version that resolves this vulnerability.Fixed in 5.8.0.24 - Upgrade
Upgrade
LexiComto a version that resolves this vulnerability.Fixed in 5.8.0.24
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55956?
CVE-2024-55956 is considered a critical vulnerability due to its potential for unauthenticated remote code execution.
How do I fix CVE-2024-55956?
To address CVE-2024-55956, users should upgrade to the latest version of Cleo Harmony, VLTrader, or LexiCom, as per the vendor's security updates.
What products are affected by CVE-2024-55956?
CVE-2024-55956 affects Cleo Harmony, Cleo VLTrader, and Cleo LexiCom versions up to 5.8.0.24.
Can CVE-2024-55956 be exploited remotely?
Yes, CVE-2024-55956 can be exploited remotely by an unauthenticated user.
What type of vulnerability is CVE-2024-55956?
CVE-2024-55956 is an unrestricted file upload vulnerability that allows execution of arbitrary commands on the host system.