CVE-2024-50623

Deeper analysis

Cleo Harmony, VLTrader, and LexiCom versions prior to 5.8.0.21 contain an unrestricted file upload and download flaw tracked as CVE-2024-50623. The issue stems from missing validation on file types and paths during transfer operations, allowing arbitrary files to be placed on or retrieved from the affected system and directly enabling remote code execution.

An unauthenticated attacker with network access can upload a malicious executable or script, then trigger its execution through the application or underlying operating system, achieving full control over the target host. The vulnerability carries a CVSS 3.1 score of 9.8, reflecting that no credentials or user interaction are required.

Cleo’s security advisory recommends immediate upgrade to version 5.8.0.21 or later for all three products. CISA has added the CVE to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild.

The associated EPSS score has reached a peak of 0.9694 with a current value of 0.9401, indicating sustained and widespread exploitation interest since disclosure.