CVE-2024-8504 VICIdial Authenticated Remote Code Execution

2024-09-1019:23:39

CWE-78

KoreLogic

www.cve.org

authenticated

vicidial

remote code execution

chained attack

shell commands

EPSS

0.003

Percentile

65.6%

JSON

An attacker with authenticated access to VICIdial as an “agent” can execute arbitrary shell commands as the “root” user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "VICIdial",
    "vendor": "VICIdial",
    "versions": [
      {
        "status": "affected",
        "version": "2.14-917a"
      }
    ]
  }
]