Article
Why Vendor Security Questionnaires Don’t Work (And What Actually Does)
Vendor security questionnaires are self-reported and out of date by the next quarter. See why they fail as a main control and what to…
Read more
Exploited vulnerability
Cleo Harmony, VLTrader and LexiCom file upload flaw (CVE-2024-50623)
CVE-2024-50623
CVE-2024-50623 is a flaw in three Cleo managed file transfer products: Harmony, VLTrader and LexiCom.
- On CISA KEV
- CVE ID
- CVE-2024-50623
- CISA KEV
- Listed
- Affected product
- Cleo Harmony, VLTrader and LexiCom
- Exploited
- Yes
- Published
- October 2024
In short
CVE-2024-50623 is a flaw in three Cleo managed file transfer products: Harmony, VLTrader and LexiCom. It allows unrestricted file upload and download that can lead to remote code execution with elevated privileges. CISA added it to its Known Exploited Vulnerabilities list in December 2024 and flags known use in ransomware campaigns.
- CVECVE-2024-50623
- ProductCleo Cleo Harmony, VLTrader and LexiCom
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps4actions listedApply the vendor's update · Follow the KEV action
What it allows
CISA says the flaw can lead to remote code execution with elevated privileges. In plain terms, an attacker could place files on the server and run commands on it. File transfer servers often hold business data, so a break-in can expose it.
Who is affected
NVD lists Cleo Harmony, VLTrader and LexiCom before version 5.8.0.21 as affected. Cleo's own advisory could not be opened for this page, so check the vendor's notice for the latest fixed release and any extra steps.
NVD published the record in October 2024. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 13 December 2024, based on evidence of active exploitation, and the entry flags known use in ransomware campaigns. The KEV required action is to apply the vendor's mitigations or stop using the product if mitigations are unavailable. CISA added a second Cleo flaw, CVE-2024-55956, on 17 December 2024.
The official sources opened for this page do not name a group behind the attacks. The wider event is covered on the incident page for the Cleo file transfer attacks.
Seen in
What to do
-
Apply the vendor's update
NVD says versions before 5.8.0.21 are affected. Check the vendor's notice for the latest fixed release, as a second Cleo flaw was added to the CISA list on 17 December 2024.
-
Follow the KEV action
CISA's required action is to apply the vendor's mitigations, or discontinue use of the product if mitigations are unavailable.
-
Take file transfer servers off the open internet
CISA notes that flaws of this type are frequent attack vectors for malicious cyber actors. Expose these servers only where needed.
-
Check for signs of earlier access
CISA lists the flaw as exploited, so review the server and the files it holds for unexpected uploads or commands, even if you have patched.
Questions
What is CVE-2024-50623?
CVE-2024-50623 is a flaw in Cleo Harmony, VLTrader and LexiCom, which are managed file transfer products. It allows unrestricted file upload and download. CISA says it can lead to remote code execution with elevated privileges.
Which Cleo versions are affected by CVE-2024-50623?
NVD lists Cleo Harmony, VLTrader and LexiCom before version 5.8.0.21 as affected. Check the vendor's notice for the latest fixed release, because a second Cleo flaw was added to the CISA list on 17 December 2024.
Is CVE-2024-50623 exploited in the wild?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 13 December 2024, based on evidence of active exploitation. The entry flags known use in ransomware campaigns. The sources opened do not name a group behind the attacks.
How do I protect against CVE-2024-50623?
Apply the vendor's update, or stop using the product if no mitigation is available, as CISA's required action says. Keep file transfer servers off the open internet where possible, and check the server for unexpected uploads or commands even after patching.
In our research
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.