Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-01-03. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 #Hacktober Alert: Critical Pre-Auth RCE in Cleo Harmony & VLTrader (CVE-2024-50623, CVSS 9.8) allows remote JSP webshell execution on MFT platforms. Read Blog: https://sh3llc0d3.com/blog/mft-infiltration-dissecting-the-cleo-harmony-vltrader-pre-auth-rce-cve-2024-50623/ #sh3llc0d3 #shellcode #Hacktober #Vulnerabilities #MFT
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | cleo | harmony | - | - | - |
| App | cleo | lexicom | - | - | - |
| App | cleo | vltrader | - | - | - |