Multiple Cleo file transfer products being exploited by hackers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-50623 | Unauthenticated RCE via Unrestricted File Upload in Cleo Harmony, VLTrader, LexiCom CVE-2024-50623 is an unrestricted file upload and download flaw (CWE-434) in Cleo's managed file transfer products — Harmony, VLTrader, and LexiCom — before version 5.8.0.21. It is reachable over the network with no authentication or user interaction (CVSS 9.8, AV:N/AC:L/PR:N), letting an attacker send crafted requests that upload arbitrary files to the server. The unrestricted upload leads to remote code execution, giving the attacker full control of the host for staging, data theft, or ransomware, while the download capability risks exposure of business files the server moves with trading partners. Any organization running these products is affected, and managed file transfer servers are typically internet-facing and handle sensitive B2B data. Exploitation is confirmed in the wild: CISA added it to the KEV catalog on 2024-12-13 with ransomware use noted, EPSS assigns a 98.6% probability of exploitation within 30 days, and the Clop ransomware gang has claimed dozens of breaches (some disputed), including a confirmed breach at WK Kellogg. Do: Upgrade Harmony, VLTrader, and LexiCom to 5.8.0.21 or later per vendor instructions; if upgrading is not possible, apply vendor mitigations or discontinue use of the product, as CISA's KEV entry requires. Prioritize internet-exposed instances, hunt for indicators of compromise (unexpected file writes and execution on the transfer host, new accounts, suspicious outbound connections), and restrict the service to trusted partner networks. Given known ransomware use by Clop, any suspected compromise should trigger checks for lateral movement and staged exfiltration of transferred files. | 9.8 | 99% | KEV ransomware |
| moderate≈1,000–3,000 internet-exposed Cleo servers (tens of thousands of enterprise deployments) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 5.8.0.21 | ely exploited in the wild and fully patched systems running 5.8.0.21 are still exploitable,” Huntress said. “We strongly recomme |
Full article489 words · extracted from therecord.media · click to collapse
Cybersecurity researchers are warning that vulnerabilities in several file transfer products are being exploited by hackers, even after a patch was released by the developer. The vulnerability — CVE-2024-50623 — was recently patched by software developer Cleo and affects the company’s LexiCom, VLTransfer and Harmony products. However, researchers at cybersecurity firm Huntress say the patch “does not mitigate the software flaw,” and that they’ve seen threat actors exploiting the bug “en masse” over the last week. “This vulnerability is being actively exploited in the wild and fully patched systems running 5.8.0.21 are still exploitable,” Huntress said. “We strongly recommend you move any internet-exposed Cleo systems behind a firewall until a new patch is released.” A Cleo spokesperson confirmed that they identified a critical vulnerability in instances of Cleo Harmony, VLTrader and LexiCom products. “Promptly upon discovering the vulnerability, we launched an investigation with the assistance of outside cybersecurity experts, notified customers of this issue and provided mitigation steps customers should immediately take to address the vulnerability while a patch is under development,” the spokesperson said. “Our investigation is ongoing. Customers are encouraged to check Cleo’s security bulletin webpage regularly for updates.” Huntress incident responders said they have seen at least 10 businesses using Cleo that have been compromised, adding that there was an uptick in exploitation starting on December 8. “After some initial analysis, however, we have found evidence of exploitation as early as December 3. The majority of customers that we saw compromised deal with consumer products, food industry, trucking, and shipping industries,” the company explained. “There are still several other companies outside of our immediate view who are potentially compromised as well.” Huntress has spoken to Cleo about its findings and confirmed that Cleo is creating a new CVE that will be patched by the middle of the week. Huntress also published detailed technical information about how incident responders can find evidence of exploitation and more. Cybersecurity expert Kevin Beaumont said Cleo initially published a paywalled advisory for customers about the issue before releasing a more limited version publicly on Tuesday. Beaumont noted that Termite ransomware group operators have been seen exploiting the vulnerability. The group made headlines last week for its attack on a prominent software company used by dozens of major retailers. Incident responders at cybersecurity firm Rapid7 confirmed Huntress’ findings and said they have seen exploitation of the issue in the environments of their customers. File transfer tools have become one of the most frequent targets for hackers and several of the biggest data theft campaigns have been sourced back to popular products like MOVEit, GoAnywhere and Accellion.
No previous article
No new articles
Jonathan Greig
is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/multiple-cleo-file-transfer-products-exploited-by-hackers