Actively exploited · CISA KEV · NVD published 2024-12-13
Actively exploitedCVE-2024-55956
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
- First PoC
- same day →Metasploit
- 178 days →First cited attacker
Signals
- Exploited in the wild
- Yesadded 2024-12-17 · due 2025-01-07 · known ransomware use. An observation, not a forecast.
- EPSS · 30-day forecast
- 94%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
- CVSS · NVD · CRITICAL
- 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Internet exposure
- not stated by sourcesNo exposure census on this CVE's dispatches.
Exploits
2 known · links onlyMetasploit1
This module exploits an unauthenticated file write vulnerability in Cleo LexiCom, VLTrader, and Harmony versions 5.8.0.23 and below.
ruby · seen 2026-10-18
Nuclei1
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
yaml · seen 2026-10-18
On the wire
0 dispatchesNo dispatch on our wire has named this CVE yet.
Watch this one?
KEV additions reach Telegram and the KEV-only RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.