Cleo Harmony, VLTrader, and LexiCom Unrestricted File Upload Remote Code Execution (RCE) Vulnerability (CVE-2024-50623) Urgent Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTCleo Harmony, VLTrader, and LexiCom versions prior to 5.8.0.21
Unauthenticated remote attackers can upload and download arbitrary files, potentially leading to full Remote Code Execution (RCE) on the target server
Immediately upgrade to version 5.8.0.21 or later, and restrict external access to the file transfer interfaces
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Administrators must immediately upgrade to Cleo version 5.8.0.21 or later. Below is an example procedure to stop the service, back up the environment, and apply the update on a Linux host.
# 1. Stop the running Cleo service
sudo systemctl stop cleo-harmony.service
# 2. Create a backup of the installation directory
tar -czvf cleo_backup_$(date +%F).tar.gz /opt/Cleo/
# 3. Execute the official update installer
./Cleo-Update-5.8.0.21.sh --mode silent
# 4. Restart the service and verify status
sudo systemctl start cleo-harmony.service
sudo systemctl status cleo-harmony.service2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict access to the Cleo web interfaces using a reverse proxy or firewall to allow only trusted IP addresses.
# Nginx configuration to restrict access to trusted IP ranges
server {
listen 443 ssl;
server_name cleo.internal.corp;
location / {
allow 192.168.10.0/24;
allow 10.0.0.0/8;
deny all;
proxy_pass http://127.0.0.1:5080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
}3. Log Audit & IoC Verification Commands
Run the following commands to check the current version and inspect logs and directories for potential indicators of compromise (IoCs).
# 1. Verify the installed Cleo version\cat /opt/Cleo/Harmony/version.txt
# 2. Search logs for suspicious POST requests containing executable extensions
grep -Ei 'POST.*(\.(jsp|sh|exe|bat|cmd|py|pl))' /opt/Cleo/Harmony/logs/*.log
# 3. Scan the webapps directory for recently modified or created JSP files
find /opt/Cleo/Harmony/webapps/ -name '*.jsp' -mtime -10 -lsBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2024-50623) is an unrestricted file upload and download flaw (CWE-434) residing in Cleo Harmony, VLTrader, and LexiCom file transfer and management interfaces. The root cause is the lack of proper validation and sanitization of file paths and extensions during upload operations, allowing unauthorized users to write arbitrary files to executable directories.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated remote attacker can exploit this vulnerability by sending crafted HTTP requests to the file upload endpoints. By bypassing extension filters or leveraging directory traversal techniques, the attacker can upload malicious scripts (such as JSP web shells) directly into the web root or other executable directories. Once uploaded, the attacker accesses the file via its web path to execute arbitrary system commands with the privileges of the Cleo application service.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability poses an immediate threat. Successful exploitation allows complete compromise of the host system, enabling attackers to exfiltrate sensitive business data, deploy ransomware, or pivot laterally into the internal corporate network.
Official Vendor Advisories & References
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.
Frequently Asked SecOps Questions (CVE-2024-50623)
FAQQ1. How critical is CVE-2024-50623 and is it actively exploited in the wild?
CVE-2024-50623 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 98.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-50623?
Primary impacted vendors include cleo across harmony, vltrader, lexicom. Scope summary: Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21
Q3. What temporary mitigations or workarounds exist for CVE-2024-50623 before patching?
[Mitigation] Immediately upgrade to version 5.8.0.21 or later, and restrict external access to the file transfer interfaces Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-50623
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (cleo)
View Category →Joomla Page Builder CK Extension Unauthenticated Remote Code Execution (RCE) Vulnerability (CVE-2026-56290)
[Affected Scope] Joomla Page Builder CK extension versions prior to 3.6.0
Joomla iCagenda Extension Arbitrary File Upload and Remote Code Execution Vulnerability (CVE-2026-48939)
[Affected Scope] Joomla iCagenda extension versions prior to 3.9.15 and 4.0.8
Joomla SP Page Builder Arbitrary File Upload and Remote Code Execution (RCE) Vulnerability (CVE-2026-48908)
[Affected Scope] Websites utilizing the SP Page Builder extension for Joomla
Joomla Balbooa Forms Extension Unauthenticated Remote Code Execution Vulnerability (CVE-2026-56291)
[Affected Scope] Joomla Balbooa Forms extension versions prior to 2.4.1
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.