CVE-2024-55956: Cleo Multiple Products Unauthenticated File Upload Vulnerability

CVE-2024-55956 is an unauthenticated file upload vulnerability affecting Cleo Harmony, VLTrader, and LexiCom managed file transfer products. An unauthenticated attacker can import and execute arbitrary bash or PowerShell commands on the host by leveraging the default settings of the Autorun directory. This matters because these products often sit at the edge of enterprise file-exchange workflows, so successful abuse can give remote code execution on systems that handle sensitive transfers. The vulnerability has known ransomware use, raising the stakes for rapid response.

How it works

The weakness is classified as CWE-276 (Incorrect Default Permissions). In practice it manifests as an unrestricted file upload that an unauthenticated user can exploit against the default Autorun directory configuration. An attacker who can reach the affected service can place content that the product then treats as executable, resulting in arbitrary bash or PowerShell command execution on the host. Exact request paths, payloads, or trigger conditions are not detailed here; defenders must confirm the precise mechanics against the vendor advisory. Because the attack requires no prior authentication, any internet-exposed or poorly segmented instance is immediately reachable.

Am I affected? How to find it in your systems

Cleo Harmony, VLTrader, and LexiCom are managed file transfer (MFT) platforms commonly deployed for B2B data exchange, EDI, and secure file movement. They typically run on Windows or Linux servers inside DMZs or dedicated transfer zones, often with web or API listeners facing partners or the internet.

• Inventory all hosts and containers running any Cleo MFT product; check software inventories, package managers, Windows services, and process lists for Harmony, VLTrader, or LexiCom binaries and services.
• Confirm installed versions and configuration against the vendor advisory; public detail on exact affected builds is limited, so treat every deployment as potentially vulnerable until verified.
• Review whether the Autorun directory is left at default permissions or is reachable without authentication; any instance that still uses the vulnerable defaults is at risk.
• Look for anomalous file creation or execution activity under the Autorun path, unexpected bash or PowerShell processes spawned by the Cleo service account, and inbound unauthenticated requests that result in new files appearing in that directory. Correlate web or application logs with host process and file-system telemetry.

How to remediate

Apply the vendor-supplied update or mitigations first. CISA directs organizations to apply mitigations per vendor instructions or to discontinue use of the product if mitigations are unavailable. After patching, re-verify that the Autorun directory no longer permits unauthenticated writes or automatic execution of uploaded content. Harden the remaining configuration by restricting write access to the Autorun path, enforcing least-privilege service accounts, and ensuring the MFT listeners are not exposed beyond necessary partner networks. Validate the fix with a controlled test that attempts an unauthenticated upload and confirms it is rejected.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Segment the MFT hosts so they are reachable only from known partner IP ranges or through a reverse proxy that enforces authentication and request filtering.
• Disable or tightly restrict the Autorun feature if the product configuration allows it; remove execute permissions from the directory and monitor for any residual write attempts.
• Deploy virtual patching or WAF rules that block unauthenticated file-upload patterns targeting the known upload endpoints (confirm exact signatures against the vendor advisory).
• Increase monitoring for new files in the Autorun directory, unexpected command interpreters launched by the Cleo process, and outbound connections that could indicate post-exploitation activity.
• If mitigations cannot be implemented, discontinue use of the product as directed by CISA until a secure configuration is available.

If your data may have been exposed

Actively exploited vulnerabilities of this class, especially those with known ransomware use, frequently lead to full host compromise and subsequent data theft or encryption. If you discover evidence of exploitation, treat the host as breached, isolate it, preserve forensic artifacts, and begin incident-response procedures. As a quick check for personal or organizational email addresses that may already appear in known breach data, you can run a free exposure scan of those addresses against public breach corpora.