Unauthenticated command injection in Cleo Harmony, VLTrader, and LexiCom Autorun handling

Successful exploitation allows remote unauthenticated execution of attacker-controlled operating system commands on the host running the vulnerable Cleo product. In observed intrusions, attackers used this access to deploy Java-based backdoors such as Malichus, conduct data theft, maintain persistence, and perform further post-exploitation activity. The practical impact therefore includes full compromise of the affected MFT server, theft of files and sensitive business data handled by the platform, and use of the server as a foothold for additional intrusion activity.

If immediate upgrade is not possible, reduce exposure of vulnerable Cleo instances as much as operationally feasible, especially any internet-accessible deployment. Restrict access to the affected service/endpoints to trusted networks, disable or tightly control use of Autorun-related functionality where possible, and monitor for unexpected file imports, command execution, shell activity, and creation of suspicious Java artifacts or backdoors. Given active exploitation, mitigation should be treated only as temporary risk reduction until upgrade to 5.8.0.24 or later is completed.

Upgrade Cleo Harmony, VLTrader, and LexiCom to version 5.8.0.24 or later, as the provided content states this version fixes CVE-2024-55956. Because the vulnerability has been reported as exploited in the wild, remediation should also include incident-response validation on previously exposed systems: review for unauthorized files or imports, inspect for persistence mechanisms and Java backdoors such as Malichus, rotate credentials that may have been exposed to the MFT environment, and assess downstream systems for follow-on compromise.