Cleo File Transfer Unauthenticated RCE (CVE-2024-29014)

CVE-2024-29014 is an unauthenticated remote code execution flaw in Cleo Harmony / LexiCom / VLTrader file-transfer appliances running on Windows or Linux. Attackers upload malicious payloads through the web console without credentials — common in B2B EDI and managed file transfer (MFT) stacks.

Affected Cleo products

• Cleo Harmony before 5.8.0.24
• LexiCom and VLTrader builds sharing the vulnerable servlet
• MFT servers with port 5080/8443 open to partners or the internet

Detect on network

nmap -p 5080,8443 --script http-title mft-subnet/24
curl -sk https://mft.example:8443/ | grep -i cleo

Remediation

• Apply Cleo vendor patch or upgrade to fixed Harmony release
• Segment MFT from corporate LAN; require site-to-site VPN for partners
• Rotate SFTP/AS2 keys and partner credentials after patch
• Review transfer logs and OS for web shells or new local admin accounts

Ransomware groups have targeted unpatched MFT — prioritize before next maintenance window.