Latest Cleo Software vulnerability (CVE-2024-50623) #
On October 27th, 2024, Cleo Software disclosed CVE-2024-50623. This vulnerability affected versions of Cleo Harmony, LexiCom, and VLTrader prior to 5.8.0.21 and allowed an attacker who successfully exploited the vulnerability to execute arbitrary code on the vulnerable system.
On December 9th, 2024, Huntress Labs published a blog post that indicated that the fix provided in October does not fully resolve the issue. Huntress has provided a proof-of-concept for the vulnerability as well as indicators of compromise. Note that there is evidence that this vulnerability is being exploited in the wild.
What is the impact? #
Successful exploitation of this vulnerability potentially allows remote code execution by an attacker against vulnerable systems. To successfully exploit a system, an attacker must have access to the Cleo web server.
Are updates or workarounds available? #
It is unclear if Cleo has updated their earlier patch for this new functionality. However, they provide mitigation advice for the previous vulnerability. It is recommended that users avoid exposing vulnerable systems to the public internet and apply strict network access control to the vulnerable systems internally, or disable the affected services until a full mitigation is confirmed to be available.
How to find potentially vulnerable systems with runZero
From the Service Inventory you can use the following query to locate potentially vulnerable systems:
service_product:Cleo
