Role
Third-party risk
See what is exposed about your suppliers from the outside, without waiting for a questionnaire, and raise it with evidence.
Read more
Significant cyber incident
Cleo file transfer attacks
In December 2024, attackers exploited two flaws, CVE-2024-50623 and CVE-2024-55956, in Cleo Harmony, VLTrader and LexiCom, which are managed file transfer products.
In short
In December 2024, attackers exploited two flaws, CVE-2024-50623 and CVE-2024-55956, in Cleo Harmony, VLTrader and LexiCom, which are managed file transfer products. The Canadian Cyber Centre learned of active exploitation on 10 December 2024, and CISA added both flaws to its Known Exploited Vulnerabilities Catalog on 13 and 17 December. The first patch did not fully close the hole, and CISA marks both flaws as used in ransomware campaigns.
What happened
Cleo makes managed file transfer software: Harmony, VLTrader and LexiCom. In October 2024 the flaw CVE-2024-50623 was published and a first update was released. Reporting later showed that systems with the first patches could still be attacked.
On 10 December 2024 the Canadian Cyber Centre became aware of reports of active exploitation. A second flaw, CVE-2024-55956, was published on 13 December and fixed in version 5.8.0.24.
CISA added the first flaw to its Known Exploited Vulnerabilities Catalog on 13 December and the second on 17 December. Its catalog marks both as used in ransomware campaigns. A California state advisory of 19 December says the exploitation possibly included the Cl0p group.
Timeline
-
October 2024
Cleo publishes its first security update for CVE-2024-50623, fixed from version 5.8.0.21
-
2024-10-28
The US National Vulnerability Database publishes CVE-2024-50623
-
2024-12-10
The Canadian Cyber Centre becomes aware of reports of active exploitation
-
2024-12-11
The Cyber Centre issues alert AL24-012; it says systems with the first patches are still exploitable
-
2024-12-13
CISA adds CVE-2024-50623 to the Known Exploited Vulnerabilities Catalog
-
2024-12-13
The National Vulnerability Database publishes CVE-2024-55956
-
2024-12-17
CISA adds CVE-2024-55956 to the Known Exploited Vulnerabilities Catalog
-
2024-12-19
The California Cybersecurity Integration Center issues an advisory; it says both flaws are used in ransomware attacks, possibly including Cl0p
-
2025-01-03
Federal due date for CVE-2024-50623
-
2025-01-07
Federal due date for CVE-2024-55956
How the attack worked
The entry point
Both flaws sit in the same three products. CVE-2024-50623 is an unrestricted file upload and download flaw that can lead to remote code execution with elevated privileges. CVE-2024-55956 lets an unauthenticated user import and run arbitrary Bash or PowerShell commands on the host, by using the default settings of the Autorun directory. The National Vulnerability Database rates both 9.8 out of 10: reachable over the network, low complexity, no privileges and no user action needed.
Why the first patch was not enough
The Canadian Cyber Centre reported that systems with the first patches were still exploitable. The California advisory says researchers recreated the exploit and found the patch ineffective. Cleo then released version 5.8.0.24 for the second flaw.
What the sources do not say
The government pages opened for this entry do not describe the attackers’ later steps, such as data theft or tools used afterwards. No ATT&CK technique ids are given by these sources, so none are listed.
Who says who was behind it
Who attributed it, and how firm it is
No public attribution by CISA or the Canadian Cyber Centre. The CISA catalog entries only mark ransomware campaign use as "Known" (read on 9 October 2026) and name no group.
Attributed by the California Cybersecurity Integration Center, 19 December 2024: exploitation in ransomware attacks "to possibly include Cl0p Ransomware Group". This is a hedged statement, not a firm finding. The Cl0p claim of responsibility itself is not documented in any government page opened for this entry.
Malware and vulnerabilities used
Impact
No government source opened for this entry gives a number of victims, names a victim, or states losses.
CISA states that exploitation is active and that both flaws are known to be used in ransomware campaigns. Both flaws are rated 9.8 critical by the National Vulnerability Database.
The sources describe the risk as remote code execution on the file transfer server. They do not state what data was taken.
Government and regulator response
- 11 December 2024: the Canadian Cyber Centre issued alert AL24-012. It asked organizations to apply mitigations, check affected systems for compromise, watch for vendor patches, patch and isolate web-facing applications.
- 13 December 2024: CISA added CVE-2024-50623 to the Known Exploited Vulnerabilities Catalog, with a federal due date of 3 January 2025.
- 17 December 2024: CISA added CVE-2024-55956, with a federal due date of 7 January 2025. The required action is to apply vendor mitigations or stop using the product.
- 19 December 2024: the California Cybersecurity Integration Center advised updating to version 5.8.0.24 at once. If that is not possible, Cleo’s workaround is to clear the Autorun directory, which reduces the attack surface but does not block incoming attacks.
- This page does not cite Cleo’s own advisories. The vendor’s statements here come through the California advisory.
Lessons
-
A first patch can fail
The Canadian Cyber Centre reported that systems with the first patches were still exploitable. After patching, confirm the fix against newer advisories and keep watching the vendor.
-
File transfer servers face the internet
Both flaws could be used without logging in. A server that must be reachable from outside needs the fastest patch cycle and limited exposure.
-
Default settings can be the weakness
CVE-2024-55956 worked through the default settings of the Autorun directory. Review defaults after install, not only patch levels.
-
The KEV list is a patch queue
CISA added both flaws within days and set due dates of 3 and 7 January 2025. Treat catalog additions as work to finish now.
-
Ransomware flags change priority
CISA marks both flaws as used in ransomware campaigns. A flaw with that flag deserves attention before others of the same score.
-
Know what you run
The advisories list affected versions and products by name. You can only act quickly if you know where such software runs, including copies run by suppliers.
What to check in your own organization
-
Find every Cleo product
List all Harmony, VLTrader and LexiCom installs, including test servers and ones run by a partner for you.
-
Check the version
Confirm each one is on 5.8.0.24 or later. Version 5.8.0.23 and earlier were listed as affected.
-
Look for signs of break-in
The Cyber Centre asks you to investigate affected systems for compromise. Review logs and files from early December 2024 onward for unexpected uploads and commands.
-
Review the Autorun directory
If you could not upgrade, check that the Autorun directory was cleared, as Cleo advised. Remember this does not block attacks.
-
Limit exposure
Check whether the web interface needs to face the internet. The Cyber Centre advises isolating web-facing applications.
-
Track the KEV catalog
Make sure someone checks new CISA catalog entries against your software list and acts by the due date.
-
Ask your suppliers
Ask partners who send you files whether they ran these products and when they patched.
Questions
Which flaws were exploited?
CVE-2024-50623 and CVE-2024-55956, both in Cleo Harmony, VLTrader and LexiCom. Both are rated 9.8 critical by the National Vulnerability Database.
When did CISA add them to its catalog?
CVE-2024-50623 on 13 December 2024 and CVE-2024-55956 on 17 December 2024.
Were they used in ransomware?
CISA's catalog marks ransomware campaign use as "Known" for both. A California state advisory of 19 December 2024 says the ransomware use possibly included the Cl0p group.
Which version is safe?
The sources name version 5.8.0.24 as the update for the second flaw. Check the vendor for newer releases.
How many organizations were hit?
The government sources opened for this entry give no number and name no victims.
Can I just turn off Autorun?
Cleo's workaround, quoted by the California advisory, is to clear the Autorun directory. It reduces the attack surface but does not block incoming attacks, so upgrading is still needed.
In our research
- Third-party risk Role
Sources
- CISA Adds One Known Exploited Vulnerability to Catalog (13 December 2024) CISA
- CISA Adds One Known Exploited Vulnerability to Catalog (17 December 2024) CISA
- Known Exploited Vulnerabilities Catalog (JSON feed) CISA
- Alert AL24-012: Vulnerability impacting all versions of Cleo VLTrader, Harmony, and LexiCom software Canadian Centre for Cyber Security
- Cleo's Harmony, VLTrader, and Lexicom Multiple Zero-Day Vulnerabilities (Cyber Advisory, 19 December 2024) California Cybersecurity Integration Center (Cal OES)
- CVE-2024-50623 record NIST National Vulnerability Database
- CVE-2024-55956 record NIST National Vulnerability Database
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.