---
title: "Cleo MFT CVE-2024-50623 and CVE-2024-55956: Cl0p RCE"
url: https://erroneo.us/security/briefs/cleo-harmony-vltrader-lexicom-cve-2024-50623-55956-rce/
description: "Unauthenticated file-write RCE in Cleo Harmony, VLTrader and LexiCom, mass-exploited by Cl0p in Dec 2024. Fixed in 5.8.0.24. Confirm the version, hunt old IOCs."
type: security-brief
section: "Security Digest"
date_published: 2024-10-27
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-50623", "CVE-2024-55956"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Cleo MFT CVE-2024-50623 and CVE-2024-55956: Cl0p RCE

**Verdict: Check exposure.** The fix has existed since December 2024; the job now is proving every Cleo server runs 5.8.0.24 or later and that no host exposed during the Cl0p campaign still carries its backdoor.

- **Who must act:** Anyone running Cleo Harmony, VLTrader or LexiCom below 5.8.0.24, and anyone whose Cleo server was internet-reachable between October and December 2024 without a completed compromise assessment.
- **Who can relax:** Organizations that do not run Cleo products, or that patched to 5.8.0.24 or later and already hunted the published indicators back to early December 2024.
- **Affected:** Cleo Harmony, VLTrader and LexiCom before 5.8.0.21 (CVE-2024-50623); Cleo Harmony, VLTrader and LexiCom before 5.8.0.24, including 5.8.0.21 (CVE-2024-55956)
- **Fixed:** Cleo Harmony, VLTrader and LexiCom 5.8.0.24 (fixes both)
- **CVEs:** CVE-2024-50623, CVE-2024-55956
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every Cleo Harmony, VLTrader and LexiCom install, including desktop LexiCom clients, and record the running version.
2. Upgrade anything below 5.8.0.24 to Cleo's current release.
3. Keep the Cleo listener off the open internet; allow only known trading-partner addresses through the firewall.
4. If you do not use Autorun, clear the Autorun Directory field under Configure, Options, Other.
5. For any host exposed in late 2024, hunt the Huntress and Rapid7 indicators and rebuild it if you find them.

### How to check if you are affected

- Look in each install's hosts folder for main.xml or 60282967-dc91-40ef-a34c-38e992509c2c.xml containing an encoded PowerShell command.
- Search the product logs (for example logs\LexiCom.xml and LexiCom.dbg) for autorun/healthchecktemplate.txt or autorun/healthcheck.txt.
- Check EDR history for javaw.exe spawning PowerShell, and for systeminfo, whoami, net group /domain or nltest /domain_trusts run under the Cleo service.
- Search firewall and proxy logs for the callback addresses Huntress and Rapid7 published, such as 176.123.5.126, 185.181.230.103 and 45.182.189.102.

## What happened

Cleo Harmony, VLTrader and LexiCom are managed file transfer products that companies use to swap files with trading partners. In October 2024, Cleo disclosed [CVE-2024-50623](https://www.cve.org/CVERecord?id=CVE-2024-50623), an unrestricted file upload and download flaw that "could lead to remote code execution." The record was published on October 27, and Cleo said version 5.8.0.21 fixed it. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-50623) scores it CVSS 3.1 9.8.

That fix did not hold. [Huntress](https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild) saw exploitation from December 3, 2024, with an uptick on December 8. It counted at least 10 compromised businesses, mostly in consumer products, food, trucking and shipping. Its researchers rebuilt the attack and ran it successfully against fully patched 5.8.0.21. Attackers wrote files into the product's `autorun` folder, which the software reads and executes automatically. Those files imported a host definition that ran PowerShell and pulled down Java (JAR) payloads with webshell-like functions. They then enumerated Active Directory.

Cleo acknowledged a new Autorun flaw on December 10, according to [Rapid7](https://www.rapid7.com/blog/post/2024/12/10/etr-widespread-exploitation-of-cleo-file-transfer-software-cve-2024-50623/), and shipped 5.8.0.24 around December 11. The issue became [CVE-2024-55956](https://www.cve.org/CVERecord?id=CVE-2024-55956) on December 13. Rapid7 later concluded it was a separate unauthenticated file-write bug in the same endpoint, not a patch bypass. CISA added CVE-2024-50623 to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50623) on December 13 and [CVE-2024-55956](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55956) on December 17. It marked both as used in ransomware campaigns. On December 15, [BleepingComputer](https://www.bleepingcomputer.com/news/security/clop-ransomware-claims-responsibility-for-cleo-data-theft-attacks/) reported that the Cl0p extortion gang claimed both campaigns.

## Who is affected

Harmony, VLTrader and LexiCom before 5.8.0.21 are vulnerable to CVE-2024-50623. All three before 5.8.0.24, including 5.8.0.21, are vulnerable to CVE-2024-55956 ([NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-55956)). Cleo's advisories ([October](https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory), [December](https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending)) sit behind a support login. Huntress notes that default installs go in `C:\Harmony`, `C:\VLTrader` or `C:\LexiCom`.

## Do you really need to act?

Most Cleo customers patched in December 2024, so a fresh emergency is unlikely today. The risk that remains is quieter. It comes from forgotten LexiCom clients and VLTrader boxes stuck below 5.8.0.24, and from hosts that were exposed during the campaign but never investigated. Cl0p stole data during the window, and Huntress and Rapid7 both saw persistence and lateral movement. Patching later did not remove a foothold. Treat this as a check-exposure item. Verify versions, then confirm someone actually hunted on any server that faced the internet between October and mid-December 2024.

## What to do now

1. Find every Cleo install, servers and desktops alike, and record the version shown in the application or its startup log.
2. Upgrade anything below 5.8.0.24 to Cleo's current release.
3. Restrict the listener to known trading-partner IPs. Rapid7 recommends keeping these products behind a firewall.
4. If you do not use Autorun, clear the **Autorun Directory** field under Configure, Options, Other, as Huntress describes.
5. Rebuild and rotate credentials on any host where you find indicators.

## How to tell if you were hit

Huntress calls a `main.xml` or `60282967-dc91-40ef-a34c-38e992509c2c.xml` in the `hosts` folder with an embedded encoded PowerShell command "a definitive indicator of compromise." On Windows, run `Get-ChildItem C:\Harmony\hosts,C:\VLTrader\hosts,C:\LexiCom\hosts -Filter *.xml | Select-String -List powershell`. Then run `Select-String -Path C:\LexiCom\logs\* -Pattern 'autorun/health'`, adjusting paths to your install. Rapid7's release-note excerpt says 5.8.0.24 logs errors for exploit-related files it removes at startup, so review the first logs written after the upgrade. In EDR data, look for `javaw.exe` spawning PowerShell, for `nltest /domain_trusts`, and for connections to `176.123.5.126`, `185.181.230.103` or `45.182.189.102`. Hunt from at least December 3, 2024, and from October if you ran versions before 5.8.0.21.

## Timeline

- Oct 27, 2024 — CVE-2024-50623 is published. Cleo lists 5.8.0.21 as the fix.
- Dec 3, 2024 — Earliest exploitation Huntress observed, including against 5.8.0.21.
- Dec 9, 2024 — Huntress publishes its advisory.
- Dec 11, 2024 — Version 5.8.0.24 appears, per Rapid7.
- Dec 13, 2024 — CVE-2024-55956 is assigned. CVE-2024-50623 is added to KEV.
- Dec 15, 2024 — Cl0p claims the attacks to BleepingComputer.
- Dec 17, 2024 — CVE-2024-55956 is added to KEV, with a January 7, 2025 federal deadline.

## Sources

1. [Cleo — Product Security Advisory (CVE-2024-50623)](https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory)
2. [Cleo — Product Security Advisory (CVE-2024-55956)](https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending)
3. [CVE record — CVE-2024-50623](https://www.cve.org/CVERecord?id=CVE-2024-50623)
4. [CVE record — CVE-2024-55956](https://www.cve.org/CVERecord?id=CVE-2024-55956)
5. [NVD — CVE-2024-50623](https://nvd.nist.gov/vuln/detail/CVE-2024-50623)
6. [NVD — CVE-2024-55956](https://nvd.nist.gov/vuln/detail/CVE-2024-55956)
7. [CISA — Known Exploited Vulnerabilities: CVE-2024-50623](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50623)
8. [CISA — Known Exploited Vulnerabilities: CVE-2024-55956](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55956)
9. [Huntress — Threat Advisory: Oh No Cleo! Cleo Software Actively Being Exploited in the Wild](https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild)
10. [Rapid7 — Widespread Exploitation of Cleo File Transfer Software (CVE-2024-55956)](https://www.rapid7.com/blog/post/2024/12/10/etr-widespread-exploitation-of-cleo-file-transfer-software-cve-2024-50623/)
11. [BleepingComputer — Clop ransomware claims responsibility for Cleo data theft attacks](https://www.bleepingcomputer.com/news/security/clop-ransomware-claims-responsibility-for-cleo-data-theft-attacks/)

---
Source page: https://erroneo.us/security/briefs/cleo-harmony-vltrader-lexicom-cve-2024-50623-55956-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt