Live › vulnerability › CVE-2024-50623
Go to dashboardCleo Harmony, VLTrader, and LexiCom are managed file transfer products with an unrestricted file upload and download flaw. An attacker can upload and retrieve files to reach remote code execution with elevated privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Cleo Multiple Products | vendor | – | – |
| cleo harmony | vendor | < 5.8.0.21 | 5.8.0.21 |
| cleo lexicom | vendor | < 5.8.0.21 | 5.8.0.21 |
| cleo vltrader | vendor | < 5.8.0.21 | 5.8.0.21 |
Identify whether Cleo Harmony, VLTrader, or LexiCom is deployed in your environment; the sources do not give a file, command, or setting to check.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2024-50623")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.