Is CVE-2024-50623 actively exploited?

Yes. CVE-2024-50623 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2024-50623 be exploited remotely?

The attack vector of CVE-2024-50623 has not been classified yet.

What is the CVSS score of CVE-2024-50623?

CVE-2024-50623 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2024-50623

HIGHCISA KEVIN THE WILD

CVE-2024-50623

Published: December 13, 2024

EPSS:94.01%probability of exploitation in 30 daysPercentile:99.9th

Official Description

Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.

NVD Source

CISA KEV Advisory

Cleo Multiple Products Unrestricted File Upload Vulnerability

Added to KEV: 2024-12-13Federal patch deadline: 2025-01-03⚠ USED IN RANSOMWARE CAMPAIGNS

Required Action (CISA)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Risk Analysis

This unrestricted file upload and download vulnerability in Cleo Harmony, VLTrader, and LexiCom managed file transfer products can lead to remote code execution with elevated privileges. The high EPSS score and confirmed exploitation in the wild indicate this is a critical threat.

This vulnerability is actively exploited in the wild and is listed in CISA's KEV catalog. It is remotely exploitable.

Recommended Action

Update Cleo Harmony, VLTrader, and LexiCom to the latest secure versions. Implement strict access controls and monitoring for file transfer operations.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2024-50623 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2024-50623 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.