OSINT - Threat Advisory: Oh No Cleo! Cleo Software Actively Being Exploited in the Wild
Cleo software is currently affected by a publicly exploitable vulnerability identified as CVE-2024-50623, which is actively exploited in the wild. This vulnerability targets public-facing applications, consistent with MITRE ATT&CK technique T1190, allowing attackers to exploit exposed services. Although the reported severity is low and no CVSS score is assigned, exploitation is industrialized, indicating automated or widespread attack attempts. No patches or affected version details are available, complicating immediate remediation efforts. The impact could affect confidentiality, integrity, or availability depending on how the vulnerability is exploited. European organizations and others with significant Cleo software adoption, especially those exposing it to the internet, are at higher risk. Recommended mitigations include increased monitoring, network segmentation, and strict access controls. Given the active exploitation and potential impact, a medium severity rating is appropriate to ensure adequate defensive measures. Organizations should prioritize detection and containment while awaiting official patches.
AI Analysis
Technical Summary
The vulnerability CVE-2024-50623 affects Cleo software, a product used in various organizational environments, particularly those with public-facing applications. This vulnerability aligns with MITRE ATT&CK technique T1190, which involves exploiting public-facing applications to gain unauthorized access or disrupt services. Although the severity is reported as low and no CVSS score has been assigned, the exploitation is described as industrialized, suggesting attackers have automated their efforts to exploit this vulnerability at scale. No patches or specific affected versions have been disclosed, which complicates immediate remediation and increases the risk of successful exploitation. The vulnerability could impact confidentiality, integrity, or availability depending on the attack vector and payload used by threat actors. The active exploitation in the wild indicates that attackers are leveraging this vulnerability to compromise systems, potentially leading to data breaches, service disruptions, or unauthorized access. Organizations using Cleo software, especially those in Europe and other regions with significant adoption, should increase their security posture by enhancing monitoring capabilities, enforcing network segmentation to isolate vulnerable systems, and applying strict access controls to limit exposure. The lack of detailed technical information and patches necessitates a focus on detection and containment strategies until official fixes are available. Given these factors, a medium severity rating is suggested to balance the current low reported severity with the real-world exploitation and potential impact.
Potential Impact
The exploitation of CVE-2024-50623 can lead to unauthorized access, data breaches, service disruption, or manipulation of data depending on the attacker's objectives and the nature of the vulnerability. Organizations with public-facing Cleo software installations are at risk of compromise, which could result in loss of confidentiality if sensitive data is accessed, integrity if data or system configurations are altered, or availability if services are disrupted. The industrialized nature of the exploitation increases the likelihood of widespread attacks, potentially affecting multiple organizations simultaneously. This can lead to operational downtime, reputational damage, regulatory penalties, and financial losses. The absence of patches and unclear affected versions prolongs exposure, increasing the window of opportunity for attackers. Organizations in critical infrastructure sectors relying on Cleo software may face heightened risks, including cascading effects on dependent systems and services. Overall, the threat poses a significant risk to organizations with internet-exposed Cleo software, necessitating urgent defensive measures.
Mitigation Recommendations
1. Implement enhanced monitoring and logging specifically targeting Cleo software components to detect anomalous activities indicative of exploitation attempts. 2. Enforce strict network segmentation to isolate Cleo software instances from critical internal networks, reducing lateral movement opportunities for attackers. 3. Apply strict access controls and multi-factor authentication for all administrative and user access to Cleo software interfaces, especially those exposed to the internet. 4. Conduct regular vulnerability scanning and penetration testing focused on public-facing applications to identify potential exposure points. 5. Limit exposure by restricting public internet access to Cleo software to only necessary IP addresses or VPN connections. 6. Develop and test incident response plans tailored to potential exploitation scenarios involving Cleo software. 7. Stay informed through vendor advisories and threat intelligence feeds for updates on patches or additional mitigation guidance. 8. Consider deploying web application firewalls (WAFs) with custom rules to detect and block exploitation attempts targeting this vulnerability. 9. Educate IT and security teams about this specific threat to ensure rapid identification and response. 10. Prepare for rapid patch deployment once official fixes become available to minimize exposure time.
Affected Countries
United States, Germany, United Kingdom, France, Netherlands, Canada, Australia, Switzerland, Belgium, Sweden
Indicators of Compromise
- vulnerability: CVE-2024-50623
- vulnerability: CVE-2024-50623
- text: In Cleo Harmony before 5.8.0.20, VLTrader before 5.8.0.20, and LexiCom before 5.8.0.20, there is a JavaScript Injection vulnerability: unrestricted file upload and download could lead to remote code execution.
- datetime: 2024-10-30T21:35:00+00:00
- datetime: 2024-10-28T00:15:00+00:00
- text: Published
- link: https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory
- ip: 176.123.5.126
- ip: 5.149.249.226
- ip: 185.181.230.103
- ip: 209.127.12.38
- ip: 181.214.147.164
- ip: 192.119.99.42
- text: all
- sigma: title: Possible Cleo MFT Exploitation 2024 id: f007b877-02e3-45b7-8501-1b78c2864029 status: experimental description: Detects Powershell spawned from Cleo software. Evidence of unknown threat actor exploiting the CLEO tooling using this pattern observed in Dec 2024. author: Tanner Filip, Austin Worline, Chad Hudson, Matt Anderson references: [] date: 2024/12/09 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: '\javaw.exe' Image|endswith: '\cmd.exe' CommandLine|contains: - 'powershell' - ' -NonInteractive' - ' -noni ' - ' -enc ' - ' -EncodedCommand' ParentCommandLine|contains: - 'VLTrader' - 'lexicom' - 'Harmony' - 'VersaLex' condition: selection falsepositives: - Unknown level: high
- sigma: title: Javaw Spawning Suspicious Powershell Commands id: a0ec945f-2328-40e9-96f6-27dadf72861b status: experimental description: Detects Javaw spawning suspicious powershell commands. This has been observed as possible post-exploitation activity of Cleo software. author: Chad Hudson, Matt Anderson references: [] date: 2024/12/09 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - '\javaw.exe' Image|endswith: - '\cmd.exe' cmdline: CommandLine|contains: - ' -nop' - ' -noni' - ' -NonInteractive' - ' -w hidden ' - ' -windowstyle hidden*' - '(New-Object Net.WebClient).Download*' - ' -enc ' - ' -EncodedCommand ' powershell: CommandLine|contains: powershell condition: selection and cmdline and powershell falsepositives: - Unknown Detects Javaw spawning suspicious powershell commands. This has been observed as possible post-exploitation activity of Cleo software.
OSINT - Threat Advisory: Oh No Cleo! Cleo Software Actively Being Exploited in the Wild
Description
Cleo software is currently affected by a publicly exploitable vulnerability identified as CVE-2024-50623, which is actively exploited in the wild. This vulnerability targets public-facing applications, consistent with MITRE ATT&CK technique T1190, allowing attackers to exploit exposed services. Although the reported severity is low and no CVSS score is assigned, exploitation is industrialized, indicating automated or widespread attack attempts. No patches or affected version details are available, complicating immediate remediation efforts. The impact could affect confidentiality, integrity, or availability depending on how the vulnerability is exploited. European organizations and others with significant Cleo software adoption, especially those exposing it to the internet, are at higher risk. Recommended mitigations include increased monitoring, network segmentation, and strict access controls. Given the active exploitation and potential impact, a medium severity rating is appropriate to ensure adequate defensive measures. Organizations should prioritize detection and containment while awaiting official patches.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2024-50623 affects Cleo software, a product used in various organizational environments, particularly those with public-facing applications. This vulnerability aligns with MITRE ATT&CK technique T1190, which involves exploiting public-facing applications to gain unauthorized access or disrupt services. Although the severity is reported as low and no CVSS score has been assigned, the exploitation is described as industrialized, suggesting attackers have automated their efforts to exploit this vulnerability at scale. No patches or specific affected versions have been disclosed, which complicates immediate remediation and increases the risk of successful exploitation. The vulnerability could impact confidentiality, integrity, or availability depending on the attack vector and payload used by threat actors. The active exploitation in the wild indicates that attackers are leveraging this vulnerability to compromise systems, potentially leading to data breaches, service disruptions, or unauthorized access. Organizations using Cleo software, especially those in Europe and other regions with significant adoption, should increase their security posture by enhancing monitoring capabilities, enforcing network segmentation to isolate vulnerable systems, and applying strict access controls to limit exposure. The lack of detailed technical information and patches necessitates a focus on detection and containment strategies until official fixes are available. Given these factors, a medium severity rating is suggested to balance the current low reported severity with the real-world exploitation and potential impact.
Potential Impact
The exploitation of CVE-2024-50623 can lead to unauthorized access, data breaches, service disruption, or manipulation of data depending on the attacker's objectives and the nature of the vulnerability. Organizations with public-facing Cleo software installations are at risk of compromise, which could result in loss of confidentiality if sensitive data is accessed, integrity if data or system configurations are altered, or availability if services are disrupted. The industrialized nature of the exploitation increases the likelihood of widespread attacks, potentially affecting multiple organizations simultaneously. This can lead to operational downtime, reputational damage, regulatory penalties, and financial losses. The absence of patches and unclear affected versions prolongs exposure, increasing the window of opportunity for attackers. Organizations in critical infrastructure sectors relying on Cleo software may face heightened risks, including cascading effects on dependent systems and services. Overall, the threat poses a significant risk to organizations with internet-exposed Cleo software, necessitating urgent defensive measures.
Mitigation Recommendations
1. Implement enhanced monitoring and logging specifically targeting Cleo software components to detect anomalous activities indicative of exploitation attempts. 2. Enforce strict network segmentation to isolate Cleo software instances from critical internal networks, reducing lateral movement opportunities for attackers. 3. Apply strict access controls and multi-factor authentication for all administrative and user access to Cleo software interfaces, especially those exposed to the internet. 4. Conduct regular vulnerability scanning and penetration testing focused on public-facing applications to identify potential exposure points. 5. Limit exposure by restricting public internet access to Cleo software to only necessary IP addresses or VPN connections. 6. Develop and test incident response plans tailored to potential exploitation scenarios involving Cleo software. 7. Stay informed through vendor advisories and threat intelligence feeds for updates on patches or additional mitigation guidance. 8. Consider deploying web application firewalls (WAFs) with custom rules to detect and block exploitation attempts targeting this vulnerability. 9. Educate IT and security teams about this specific threat to ensure rapid identification and response. 10. Prepare for rapid patch deployment once official fixes become available to minimize exposure time.
Technical Details
- Threat Level
- 3
- Analysis
- 2
- Uuid
- 5ac29be4-309c-436f-84ff-49dd4f98e940
- Original Timestamp
- 1733842681
Indicators of Compromise
Vulnerability
| Value | Description | Copy |
|---|---|---|
vulnerabilityCVE-2024-50623 | — | |
vulnerabilityCVE-2024-50623 | — |
Text
| Value | Description | Copy |
|---|---|---|
textIn Cleo Harmony before 5.8.0.20, VLTrader before 5.8.0.20, and LexiCom before 5.8.0.20, there is a JavaScript Injection vulnerability: unrestricted file upload and download could lead to remote code execution. | — | |
textPublished | — | |
textall | — |
Datetime
| Value | Description | Copy |
|---|---|---|
datetime2024-10-30T21:35:00+00:00 | — | |
datetime2024-10-28T00:15:00+00:00 | — |
Link
| Value | Description | Copy |
|---|---|---|
linkhttps://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory | — |
Ip
| Value | Description | Copy |
|---|---|---|
ip176.123.5.126 | — | |
ip5.149.249.226 | — | |
ip185.181.230.103 | — | |
ip209.127.12.38 | — | |
ip181.214.147.164 | — | |
ip192.119.99.42 | — |
Sigma
| Value | Description | Copy |
|---|---|---|
sigmatitle: Possible Cleo MFT Exploitation 2024
id: f007b877-02e3-45b7-8501-1b78c2864029
status: experimental
description: Detects Powershell spawned from Cleo software. Evidence of unknown threat actor exploiting the CLEO tooling using this pattern observed in Dec 2024.
author: Tanner Filip, Austin Worline, Chad Hudson, Matt Anderson
references: []
date: 2024/12/09
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: '\javaw.exe'
Image|endswith: '\cmd.exe'
CommandLine|contains:
- 'powershell'
- ' -NonInteractive'
- ' -noni '
- ' -enc '
- ' -EncodedCommand'
ParentCommandLine|contains:
- 'VLTrader'
- 'lexicom'
- 'Harmony'
- 'VersaLex'
condition: selection
falsepositives:
- Unknown
level: high | — | |
sigmatitle: Javaw Spawning Suspicious Powershell Commands
id: a0ec945f-2328-40e9-96f6-27dadf72861b
status: experimental
description: Detects Javaw spawning suspicious powershell commands. This has been observed as possible post-exploitation activity of Cleo software.
author: Chad Hudson, Matt Anderson
references: []
date: 2024/12/09
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- '\javaw.exe'
Image|endswith:
- '\cmd.exe'
cmdline:
CommandLine|contains:
- ' -nop'
- ' -noni'
- ' -NonInteractive'
- ' -w hidden '
- ' -windowstyle hidden*'
- '(New-Object Net.WebClient).Download*'
- ' -enc '
- ' -EncodedCommand '
powershell:
CommandLine|contains: powershell
condition: selection and cmdline and powershell
falsepositives:
- Unknown
Detects Javaw spawning suspicious powershell commands. This has been observed as possible post-exploitation activity of Cleo software. | — |
Threat ID: 682c7dbfe8347ec82d2cf3d6
Added to database: 5/20/2025, 1:03:59 PM
Last enriched: 2/26/2026, 1:01:52 AM
Last updated: 3/26/2026, 8:37:27 AM
Views: 114
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.