Unrated severityCISA KEVNVD Advisory· Published Oct 27, 2024· Updated Oct 21, 2025

CVE-2024-50623

Description

In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.

Affected products

Cleo/Harmonydescription
Apache/Harmonyllm-fuzzy
Range: <5.8.0.21
Cleo/VLTraderllm-fuzzy
Range: <5.8.0.21
Cleo/LexiComllm-fuzzy
Range: <5.8.0.21

Patches

Vulnerability mechanics

References

support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisorymitre

News mentions

Risky Business #774 -- Cleo file transfer appliances under widespread attack
Risky Business · Dec 11, 2024

cvss	0.000
epss	0.079
exploit	0.000
kev	0.120
patch	0.000
ransomware	0.060