Unpatched Chaos: Cleo’s File Transfer Snafu Sparks Wild Exploitation Frenzy!
Cleo’s file transfer products are caught in a cyber tango with CVE-2024-50623. Huntress found the previous patch didn’t stick, leaving hackers to cha-cha their way into systems. With 10 businesses already compromised, Cleo is now rushing to release a new patch before it becomes a full-blown hacker hoedown.
Hot Take:
Looks like Cleo’s got a hole in their bucket, dear Liza, dear Liza! In the wild west of cybersecurity, it seems like Cleo’s patchwork attempt has left more of a patchy mess. Who knew file transfers could be more dangerous than a toddler with a crayon on your freshly painted walls?
Key Points:
- Huntress warns of exploitation of Cleo’s file transfer products due to an improperly patched vulnerability.
- The vulnerability, CVE-2024-50623, impacts Cleo Harmony, VLTrader, and LexiCom.
- Attackers have been exploiting the vulnerability since early December, affecting multiple industries.
- Huntress and Rapid7 report on the ongoing exploitation and post-exploitation activities.
- Cleo is working on a new patch and mitigation recommendations are available to logged-in users.
Already a member? Log in here