CVE-2024-50623

In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

98.61% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2024-12-13, used in ransomware campaigns

Nuclei

high · CWE-434

Published

2024-10-27

Updated

2026-10-07

Proof-of-concept exploits (5)

• congdong007/CVE-2024-50623-poc0★ · 2025-04-01
• fl4m3-s/Cleo_Unauth_RCE2★ · 2025-01-14
• iSee857/Cleo-CVE-2024-50623-PoC5★ · 2025-04-01
• verylazytech/CVE-2024-506237★ · 2024-12-23
• watchtowrlabs/CVE-2024-5062325★ · 2024-12-11

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50623.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cleo_rce_cve_2024_559…

Exploit collections (1)

• CVE-2024-50623.yamlzan8in/afrog

Security advisories

• https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory

References

• CVE Record
• NVD entry

Related

• CVE-2024-45216
• CVE-2025-29306
• CVE-2024-55956
• CVE-2024-8190
• CVE-2024-8963
• CVE-2024-9379