Active Exploitation Alert on a Critical Vulnerability in Cleo File-Transfer Software

by | Dec 13, 2024

Threat actors are actively exploiting a critical vulnerability found in Cleo file-transfer software. Vulnerability CVE-2024-50623 is thought to be a patched vulnerability. In the past, it permits file uploads and downloads without restriction. Dangerous file types were also impacted. If the vulnerability is exploited successfully, the result could be remote code execution.

The vulnerability impacts these Celo products:

  • Cleo VLTrader before 5.8.0.21
  • Cleo Harmony before 5.8.0.21
  • Cleo LexiCom before 5.8.0.21

Cleo released a patch to correct the vulnerability last October, but the patch doesn’t fully protect against attack. Huntress researchers have noticed mass exploitation and post-exploitation activity in patched and unpatched variations of the impacted products from December 3, 2024. An examination of the attacks made it possible for Huntress to create a proof-of-concept exploit for the vulnerability, although they think threat actor activity utilizes a similar method to exploit the vulnerability, they lack the complete information on the vulnerability so it’s impossible to say if that was the case. Threat actors are likely utilizing another attack vector. Rapid7 researchers explained they saw an exploitation of the vulnerability in customer settings that succeeded.

As per Huntress, companies breached through this vulnerability were typically in the food, consumer goods, trucking, and shipping industries. After disclosing their information with Cleo, Huntress stated it would have a new CVE and would issue a patch to resolve the problem this week. On December 10, 2024, Cleo notified customers regarding a critical vulnerability that made it possible for unauthenticated attackers to transfer and implement arbitrary bash and PowerShell codes by using the default configurations of the Autorun directors. Concerned companies should take note of this alert for HIPAA training and cybersecurity updates.

While the patch is not yet available for application, all end users of the impacted products must remove access to them from the public online and look for the Indicators of Compromise (IoCs) provided by Huntress to find out whether a threat actor already exploited the vulnerability. The threat actor responsible for the attacks is still unidentified. Although the Clop cybercrime group is a suspect in similar incidents like the exploitation of zero-day vulnerabilities in Fortra’s GoAnywhere, the Accellion FTA, and MOVEit file transfer solutions of Progress Software. Security researcher Kevin Beaumont believes the Termite ransomware group might be responsible for the attacks, and states they have a running exploit for the vulnerability.

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

COMPREHENSIVE HIPAA TRAINING

Please enable JavaScript in your browser to complete this form.

Ryan Coyne

Ryan Coyne is a results-driven leader in the healthcare compliance industry, specializing in regulatory compliance, compliance training, and assisting healthcare organizations and business associates in achieving and maintaining compliance. With a deep knowledge of healthcare regulations and a keen understanding of the challenges faced by the industry, Ryan has developed a reputation as a trusted advisor and advocate for ethical and compliant practices in healthcare. Ryan has successfully advised and guided numerous healthcare organizations, business associates, and healthcare professionals on achieving and maintaining compliance with regulatory training requirements. Ryan's professional focus is using his in-depth expertise and leading a world class team of subject matter experts at ComplianceJunction in regulatory compliance to help organisations navigate the complex landscape of ensuring staff adhere to healthcare regulations. You can connect with Ryan via LinkedIn and follow on Twitter

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

Comprehensive HIPAA Training

Used in 1000+ Healthcare Organizations and 100+ Universities

    Full Course - Immediate Access

    Privacy Policy