CISA Known Exploited Vulnerability (KEV)
Cleo Multiple Products Unauthenticated File Upload Vulnerability
December 17, 2024
January 7, 2025
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.