CVE-2024-50623

Timeline

Detection, updates, and resolution for this record.

1. Oct 27, 2024 · Catalog

   Detected

   Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.

2. Dec 13, 2024 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

3. Jan 3, 2025 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

4. Oct 8, 2026 · Catalog

   Updated

   Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.

Affected

• cpe cleo/harmonyversion unspecified
• cpe cleo/lexicomversion unspecified
• cpe cleo/vltraderversion unspecified
• vendor Cleo Multiple Productsversion unspecified

Sources

• CISA KEVCVE-2024-50623

  Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.

  cisa.gov
• CVE.orgCVE-2024-50623

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2024-50623

  30-day exploitation probability 98.6%

  first.org
• Metasploit Modulesexploit_multi/http/cleo_rce_cve_2024_55956

  Public module reference (excellent). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDCVE-2024-50623

  In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• Vendor Advisory · support.cleo.com
• CISA note · support.cleo.com
• US Government Resource · cisa.gov