Actively exploited in the wild
Cleo Multiple Products Unrestricted File Upload Vulnerability
Cleo - Multiple Products · Listed in the CISA KEV since 2024-12-13. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-50623
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
Unrestricted file upload and download in Cleo Harmony, VLTrader, and LexiCom before 5.8.0.21, potentially leading to remote code execution.
Risk Assessment
An attacker can upload malicious files to the server and execute code, potentially leading to system compromise and data theft.
Recommendation
Immediately update Cleo Harmony, VLTrader, and LexiCom to version 5.8.0.21 or later and restrict access to these systems.
Original NVD description (English source)
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.