{"id":"CVE-2024-50623","kind":"vulnerability","aliases":["CVE-2024-50623"],"related":[],"title":"In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted…","description":"Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Cleo Harmony, VLTrader, and LexiCom are managed file transfer products with an unrestricted file upload and download flaw. An attacker can upload and retrieve files to reach remote code execution with elevated privileges.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2024-12-13T00:00:00+00:00","products":[{"name":"Cleo Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"cleo harmony","fixed":["5.8.0.21"],"affected":"< 5.8.0.21","ecosystem":"vendor"},{"name":"cleo lexicom","fixed":["5.8.0.21"],"affected":"< 5.8.0.21","ecosystem":"vendor"},{"name":"cleo vltrader","fixed":["5.8.0.21"],"affected":"< 5.8.0.21","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cleo","exploited","managed-file-transfer","ransomware","self-hosted","vendor"],"not_affected_if":["product-not-deployed"],"how_to_check":"Identify whether Cleo Harmony, VLTrader, or LexiCom is deployed in your environment; the sources do not give a file, command, or setting to check.","fix":"Apply the vendor mitigations from Cleo, or discontinue use of the affected product if mitigations are unavailable, per CISA's required action. Specific fixed versions: unknown","status":"open","published_at":"2024-10-28T00:15:03+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:02+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:56:02Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations from Cleo, or discontinue use of the affected product if mitigations are unavailable, per CISA's required action. Specific fixed versions: unknown","reach":"unknown","impact":"high","summary":"Cleo Harmony, VLTrader, and LexiCom are managed file transfer products with an unrestricted file upload and download flaw. An attacker can upload and retrieve files to reach remote code execution with elevated privileges.","category":"vendor","who_cares":["cleo","managed-file-transfer","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code with elevated privileges on the file transfer server.","analyst_note":"Find Cleo's vendor advisory for affected and fixed versions, the mitigation steps, and whether authentication is required; check the CISA KEV entry for the due date.","how_to_check":"Identify whether Cleo Harmony, VLTrader, or LexiCom is deployed in your environment; the sources do not give a file, command, or setting to check.\nunknown","needs_analyst":true,"not_affected_if":["product-not-deployed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000501,"input_tokens":2840,"output_tokens":435,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':18A,21A '-50623':19A,22A '5.8.0.21':5A,8A,12A 'action':107C 'appli':108C 'attack':62B 'cisa':105C 'cleo':2A,23A,26A,28A,30A,32B,43B,76C 'code':71B,100C 'contain':87C 'cve':17A,20A 'discontinu':114C 'download':59B,93C 'elev':74B,103C 'execut':72B,101C 'exploit':33B 'file':36B,50B,56B,67B,84C,90C 'flaw':60B 'harmoni':3A,44B,77C 'harmony':27A 'host':41B 'instruct':112C 'lead':97C 'lexicom':10A,29A,47B,80C 'manag':35B,49B,83C 'managed-file-transf':34B 'mitig':109C,120C 'multiple':24A 'per':110C 'privileg':75B,104C 'product':52B,86C,118C 'products':25A 'ransomwar':38B 'reach':69B 'remot':70B,99C 'requir':106C 'retriev':66B 'self':40B 'self-host':39B 'transfer':37B,51B,85C 'unavail':122C 'unrestrict':16A,55B,89C 'upload':57B,64B,91C 'use':115C 'vendor':42B,111C 'vltrader':6A,31A,45B,78C 'vulner':94C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-10-28T00:15:03+00:00","kev":{"dateAdded":"2024-12-13","dueDate":"2025-01-03","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-50623","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-50623","severity":null,"published_at":"2024-12-13T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T13:39:30+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-50623","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50623","severity":null,"published_at":"2024-10-28T00:15:03+00:00","modified_at":"2026-10-08T10:35:08+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}