{"id":"CVE-2024-50623","published":"2024-10-28T00:15:03Z","modified":"2026-10-08T10:35:08Z","title":"Cleo Multiple Products Unrestricted File Upload Vulnerability","vendor":"Cleo","product":"Multiple Products","tier":"core","eol":null,"description":{"text":"In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an unrestricted file upload and download weakness in Cleo's Harmony, VLTrader, and LexiCom products prior to version 5.8.0.21. An attacker who can reach the affected product over the network, without authentication or user interaction, can upload a file of a dangerous type and use it to achieve remote code execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:01:38Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.98607,"percentile":0.99923,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-12-13","dueDate":"2025-01-03","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update ; https://nvd.nist.gov/vuln/detail/CVE-2024-50623","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-12-09","exploitedFirstSeen":"2024-12-09","ransomware":true,"evidence":[{"url":"https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild","date":"2024-12-09"},{"url":"https://cyberplace.social/@GossiTheDog/113628339890303857","date":"2024-12-10"},{"url":"https://www.rapid7.com/blog/post/2024/12/10/etr-widespread-exploitation-of-cleo-file-transfer-software-cve-2024-50623/","date":"2024-12-10"},{"url":"https://infosec.exchange/@SophosXOps/113631363563332166","date":"2024-12-11"},{"url":"https://labs.watchtowr.com/cleo-cve-2024-50623/","date":"2024-12-11"},{"url":"https://www.binarydefense.com/resources/blog/cleo-mft-mass-exploitation-payload-analysis/","date":"2024-12-11"},{"url":"https://www.rapid7.com/blog/post/2024/12/11/etr-modular-java-backdoor-dropped-in-cleo-exploitation-campaign/","date":"2024-12-11"},{"url":"https://x.com/watchtowrcyber/status/1866838624131793215","date":"2024-12-11"},{"url":"https://arcticwolf.com/resources/blog-uk/cleopatras-shadow-a-mass-exploitation-campaign-uk/","date":"2024-12-12"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-12-13"}],"evidenceTotal":85,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"}],"references":[{"url":"https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50623","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated network exploitation of public-facing application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"there is an unrestricted file upload and download","start":88,"end":137}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Uploaded file enables remote code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"could lead to remote code execution","start":143,"end":178}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-45217","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-45217","exploited":true,"exploitedSince":"2024-12-13","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":1,"earliest":"2024-12-11","earliestUrl":"https://github.com/watchtowrlabs/CVE-2024-50623","repos":[{"name":"watchtowrlabs/CVE-2024-50623","url":"https://github.com/watchtowrlabs/CVE-2024-50623","stars":25,"created":"2024-12-11"},{"name":"verylazytech/CVE-2024-50623","url":"https://github.com/verylazytech/CVE-2024-50623","stars":7,"created":"2024-12-23"},{"name":"iSee857/Cleo-CVE-2024-50623-PoC","url":"https://github.com/iSee857/Cleo-CVE-2024-50623-PoC","stars":5,"created":"2024-12-31"}]},"nuclei":[{"id":"CVE-2024-50623","name":"Cleo Harmony < 5.8.0.21 - Arbitary File Read","severity":"high","path":"http/cves/2024/CVE-2024-50623.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50623.yaml"}],"first":{"date":"2024-12-11","source":"PoC-in-GitHub","url":"https://github.com/watchtowrlabs/CVE-2024-50623"},"provenance":"source"},"detections":{"cveRules":[{"title":"CVE-2024-50623 Exploitation Attempt - Cleo","id":"f007b877-02e3-45b7-8501-1b78c2864029","level":"high","status":"experimental","path":"rules-emerging-threats/2024/Exploits/CVE-2024-50623/proc_creation_win_exploit_cve_2024_50623_cleo.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-50623/proc_creation_win_exploit_cve_2024_50623_cleo.yml","techniques":["T1190"]}]},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2024-10-28","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50623","provenance":"source"},{"date":"2024-12-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild","provenance":"source"},{"date":"2024-12-11","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/watchtowrlabs/CVE-2024-50623","provenance":"source"},{"date":"2024-12-13","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-12-13","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-45217","provenance":"source"}],"speed":{"daysToPublicExploit":44,"firstExploitFrom":"PoC-in-GitHub","daysToKev":46},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 690 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9992"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}