In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
References
| Link | Resource |
|---|---|
| https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending | Vendor Advisory |
| https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update | Vendor Advisory |
| https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
20 Dec 2024, 15:21
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Cleo vltrader
Cleo lexicom Cleo harmony Cleo |
|
| CWE | CWE-77 | |
| CPE | cpe:2.3:a:cleo:lexicom:*:*:*:*:*:*:*:* cpe:2.3:a:cleo:vltrader:*:*:*:*:*:*:*:* cpe:2.3:a:cleo:harmony:*:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| References | () https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild - Exploit, Third Party Advisory | |
| References | () https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update - Vendor Advisory | |
| References | () https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending - Vendor Advisory |
13 Dec 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-12-13 21:15
Updated : 2025-03-14 20:48
NVD link : CVE-2024-55956
Mitre link : CVE-2024-55956
JSON object : View
Products Affected
cleo
- harmony
- vltrader
- lexicom
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')