Cleo MFT CVE-2024-50623 and CVE-2024-55956: Cl0p RCE
The fix has existed since December 2024; the job now is proving every Cleo server runs 5.8.0.24 or later and that no host exposed during the Cl0p campaign still carries its backdoor.
Must act: Anyone running Cleo Harmony, VLTrader or LexiCom below 5.8.0.24, and anyone whose Cleo server was internet-reachable between October and December 2024 without a completed compromise assessment.
Can relax: Organizations that do not run Cleo products, or that patched to 5.8.0.24 or later and already hunted the published indicators back to early December 2024.
- Inventory every Cleo Harmony, VLTrader and LexiCom install, including desktop LexiCom clients, and record the running version.
- Upgrade anything below 5.8.0.24 to Cleo's current release.
- Keep the Cleo listener off the open internet; allow only known trading-partner addresses through the firewall.