Read the docs
TI-2024-36997 Aliases CVE-2024-55956GHSA-v87c-pw6c-99w6

In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24…

Priority CRITICAL 100Exploited in the wildCWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-77.

Summary

In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.

Why it matters now

Exploitation Active In CISA KEV since 2024-12-17CISA due date 2025-01-07Known ransomware use
EPSS 0.93968 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:cleo:harmony:*:*:*:*:*:*:*:*before 5.8.0.24VulnerableCleo
cpe:2.3:a:cleo:lexicom:*:*:*:*:*:*:*:*before 5.8.0.24VulnerableCleo
cpe:2.3:a:cleo:vltrader:*:*:*:*:*:*:*:*before 5.8.0.24VulnerableCleo
  • cpe:2.3:a:cleo:harmony:*:*:*:*:*:*:*:* Versions before 5.8.0.24 Vulnerable ·Cleo
  • cpe:2.3:a:cleo:lexicom:*:*:*:*:*:*:*:* Versions before 5.8.0.24 Vulnerable ·Cleo
  • cpe:2.3:a:cleo:vltrader:*:*:*:*:*:*:*:* Versions before 5.8.0.24 Vulnerable ·Cleo

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2024-12-17 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2024-55956
  3. 2026-10-03 Alias added: GHSA-v87c-pw6c-99w6

References

Exploit 1

Advisory 2

  • TI-2024-34043 In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21… KEVCVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences