CVEブラウザに戻る

CVE-2024-55956

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2024-12-13

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.

Affected Platforms (CPE)

📦

Cleo

Harmony

< 5.8.0.24

📦

Cleo

Lexicom

< 5.8.0.24

📦

Cleo

Vltrader

< 5.8.0.24

References & Advisories

🔗 https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending

🔗 https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update

🔗 https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55956

関連する脆弱性情報

CVE-2025-563859.8

A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83 within the 'xmHarmony.asp' e...

CVE-2025-38318.1

Log files uploaded during troubleshooting by the Harmony SASE agent may have been accessible to unauthorized parties.

CVE-2024-352955.2

A vulnerability has been identified in Perfect Harmony GH180 (All versions >= V8.0 < V8.3.3 with NXGPro+ controller manufactured b...

CVE-2024-506239.8

In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and d...