CVE-2024-55956Cleo Multiple Products Unauthenticated File Upload Vulnerability

In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.

9.8 CRITICALEPSS 93.96%⚡ Known Exploited (CISA KEV)NVD: Published

Last updated: 2026-08-05 03:55 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
9.8	CRITICAL	3.1CISA-ADP	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CVE ID: CVE-2024-55956
Status: Published
Assigner (CNA): mitre
Published: Dec 13, 2024
Last modified: 2026-08-05 03:55 UTC
Weaknesses: CWE-276

Sources

NVD (unavailable at last refresh)
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-07 15:44 UTC.