CVE-2024-50623

CRITICALCVSS 9.8Known Exploited

CISA Known Exploited Vulnerability

https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update ; https://nvd.nist.gov/vuln/detail/CVE-2024-50623

Remediation deadline: January 3, 2025

Ransomware use: Known

Description

Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.

Timeline

Published:October 28th, 2024 12:15 AM

Last modified:July 31st, 2026 4:16 AM

Added to KEV:December 13th, 2024

CVSS Scoring

CVSS v3: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Software

From NVD CPE configuration data

Vendors

cleo

Products

harmonylexicomvltrader

Weaknesses (CWE)

CWE-434

References & Reports

Advisories, patches, and third-party reports

https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-AdvisoryVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50623US Government Resource

Source: NIST NVD · Data may lag official sources by up to one minute