Cleo - RCE (CVE-2024-50623)
Description
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.
psychologyCrowdSec Analysis
CVE-2024-50623 is a critical vulnerability in Cleo Harmony, VLTrader, and LexiCom that allows for unrestricted file upload and download, potentially resulting in remote code execution.
CrowdSec has been tracking this vulnerability and its exploits since 18th of December 2024.
CrowdSec network data shows that most actors exploiting CVE-2024-50623 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2024-50623 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2024-50623 is currently experiencing high visibility and active exploitation across the internet.
Observed attack attempts are primarily focused on the /synchronization endpoint.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-10-27 |
| CISA KEV | 2024-12-13 |
| Rule Released | 2024-12-18 |
| CrowdSec First Seen | 2024-12-19 |
| CISA Remediation Deadline | 2025-01-03 |