Cleo Multiple Products

What it is

Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vendor notices and references

• support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update
• nvd.nist.gov/vuln/detail/CVE-2024-50623

Description and required action as published by CISA. Full record at NVD.