CVE-2024-55956

What it actually does

CVE-2024-55956 is an unauthenticated command execution flaw in Cleo Harmony, VLTrader, and LexiCom versions before 5.8.0.24. The products’ default Autorun directory behavior can be abused to import attacker-supplied content that is then executed as Bash or PowerShell on the underlying host. Successful exploitation gives the attacker operating-system-level command execution in the security context of the Cleo service account, enabling file access, malware staging, credential theft, persistence, and lateral movement from a managed file transfer server.

Why it matters to the business

This is a critical, internet-exploited flaw in managed file transfer software, a class of systems that often handles sensitive business documents, partner data, credentials, and automated transfer workflows. It is listed in CISA KEV, has very high EPSS likelihood, has been associated with ransomware activity, and had a CISA remediation deadline of 2025-01-07, so any remaining exposure should be treated as urgent. Compromise can result in data theft, operational disruption of file transfer processes, extortion, ransomware deployment, partner trust impact, regulatory exposure, and incident response costs.

How an attack unfolds

An attacker first identifies an exposed Cleo Harmony, VLTrader, or LexiCom instance running a vulnerable version prior to 5.8.0.24. Without valid credentials, the attacker abuses the product’s Autorun import behavior to place or reference attacker-controlled content in a location processed by the application. Because the vulnerable default behavior allows imported Autorun content to execute host commands, the attacker embeds Bash or PowerShell instructions that run under the Cleo service account. Initial commands commonly establish execution, collect host and application context, write additional payloads, or retrieve tooling from external infrastructure. From there, the attacker may enumerate files and configured trading partners, harvest secrets or transfer credentials, exfiltrate data staged on the managed file transfer server, install persistence, and pivot into the broader network. Public reporting links exploitation of this vulnerability class to active zero-day campaigns by espionage and financially motivated actors, including ransomware-related activity, so exploitation should be investigated as potential hands-on-keyboard compromise rather than a simple scanner event.

How to fix it

Upgrade Cleo Harmony, VLTrader, and LexiCom to version 5.8.0.24 or later immediately. If an upgrade cannot be completed at once, restrict all external access to the Cleo service using VPN, allowlisted source IPs, firewall rules, or reverse proxy controls; disable or tightly control Autorun functionality where operationally possible; remove write access to Autorun directories except for required service identities; and monitor or block unexpected script execution by the Cleo service account. Because exploitation is active in the wild and associated with ransomware campaigns, patching alone is not sufficient for previously exposed systems: preserve evidence, review Autorun contents, rotate credentials and secrets stored or used by the product, and assess for post-exploitation activity.

How to confirm the fix worked

Confirm the installed product version is 5.8.0.24 or later for every Cleo Harmony, VLTrader, and LexiCom instance, including disaster recovery, test, legacy, and partner-facing deployments. Validate that the Autorun directory cannot be written to or abused by unauthenticated users and that unexpected files are not present. Review product configuration to ensure remote administrative or file-transfer interfaces are not broadly exposed. Use file integrity checks to compare Autorun, hosts, mailbox, scripts, and installation directories against known-good baselines. Confirm endpoint controls alert when the Cleo service launches PowerShell, bash, cmd, curl, wget, certutil, bitsadmin, or other living-off-the-land tooling. Where feasible, run an authenticated configuration review or vendor-supported health check rather than relying only on external network scans.

Typical attack path

1. Scan the internet or known partner-facing infrastructure for Cleo Harmony, VLTrader, or LexiCom services.
2. Fingerprint the product and version to identify instances running versions before 5.8.0.24.
3. Submit or import attacker-controlled Autorun content without authentication.
4. Cause the Cleo application to process the Autorun content and execute embedded Bash or PowerShell commands on the host.
5. Run discovery commands to determine OS, privileges, network context, product paths, and stored transfer configurations.
6. Download or write second-stage scripts, web shells, remote access tools, or data collection utilities.
7. Access files, logs, credentials, certificates, transfer configurations, and partner data available to the Cleo service account.
8. Exfiltrate sensitive data and optionally use the host as a foothold for lateral movement.
9. Deploy persistence or ransomware tooling where the campaign objective is extortion or disruption.

How to detect it

Investigate whether the Cleo service account or process spawned command interpreters or scripting tools, especially around the first observed exposure window and any time before upgrade to 5.8.0.24. Review Cleo application logs, Autorun processing logs, operating system security logs, EDR process telemetry, web server or reverse proxy logs, firewall logs, DNS logs, and file creation events. Focus on unauthenticated requests followed by new files in Autorun directories, PowerShell or Bash execution, outbound network connections, archive creation, credential access, or transfer of unusual volumes of data. On Windows, review Event ID 4688 process creation, PowerShell operational logs, Sysmon process/file/network events, service creation events, scheduled task creation, and antivirus/EDR detections. On Linux, review shell history where available, auditd process execution, syslog/auth logs, cron changes, systemd unit creation, and unusual files under Cleo installation paths. Look for execution chains where the parent process is the Cleo application or Java runtime and the child process is powershell.exe, cmd.exe, bash, sh, curl, wget, certutil.exe, bitsadmin.exe, or compression tools. Also hunt for newly created files in Autorun directories, unexpected scripts, encoded PowerShell, Base64 payloads, outbound HTTP/S callbacks, creation of archives from transfer directories, and access to credential stores or configuration files.

• C:\Program Files\Cleo\Harmony\autorun\
• C:\Program Files\Cleo\VLTrader\autorun\
• C:\Program Files\Cleo\LexiCom\autorun\
• C:\Cleo\Harmony\autorun\
• C:\Cleo\VLTrader\autorun\
• C:\Cleo\LexiCom\autorun\
• /opt/Cleo/Harmony/autorun/
• /opt/Cleo/VLTrader/autorun/
• /opt/Cleo/LexiCom/autorun/
• /usr/local/Cleo/Harmony/autorun/
• /usr/local/Cleo/VLTrader/autorun/
• /usr/local/Cleo/LexiCom/autorun/
• powershell.exe -EncodedCommand
• powershell.exe -enc
• powershell.exe -nop
• powershell.exe -ExecutionPolicy Bypass
• cmd.exe /c powershell
• bash -c
• sh -c
• curl http
• curl https
• wget http
• wget https
• certutil.exe -urlcache
• bitsadmin /transfer
• java.exe -> powershell.exe
• java.exe -> cmd.exe
• java.exe -> certutil.exe
• java.exe -> bitsadmin.exe
• java -> bash
• java -> sh
• Autorun
• autorun

What your security team should do

• Treat all internet-exposed Cleo Harmony, VLTrader, and LexiCom servers below 5.8.0.24 as potentially compromised and prioritize them for emergency remediation.
• Upgrade to 5.8.0.24 or later, then verify the version from the application and the filesystem rather than assuming the update completed successfully.
• Immediately restrict inbound access to Cleo services to trusted networks or partner IP ranges only.
• Preserve application logs, Autorun directory contents, web/proxy logs, EDR telemetry, and filesystem timestamps before cleanup where compromise is suspected.
• Hunt for suspicious child processes spawned by the Cleo service, especially PowerShell, bash, cmd, sh, curl, wget, certutil, bitsadmin, mshta, rundll32, or encoded PowerShell commands.
• Inspect Autorun directories for newly created, modified, hidden, or unusual files and compare against operational baselines.
• Rotate credentials, API keys, certificates, SSH keys, and partner transfer secrets stored in or used by the affected products.
• Search for outbound connections from Cleo servers to unfamiliar IP addresses, file-sharing services, paste sites, VPS providers, or newly registered domains.
• Segment managed file transfer servers from internal networks and limit the service account’s local and network privileges.
• Escalate to full incident response if there are signs of command execution, unknown Autorun files, data staging, archive creation, credential access, or ransomware tooling.