CVE-2024-8504CWE-78

VICIdial Authenticated Remote Code Execution

High · published September 10, 2024

Patch now

High probability of exploitation

CVSS calls it high at 8.8. It sits in the 99.5th percentile for exploit probability.

CVSS v3.1

8.8

EPSS

76%

Percentile

99.5

In the wild

Unconfirmed

What it is

An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.76217 · 99.5th percentile
Weakness: CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2024-09-10T19:23Z

EPSS history

Timeline

10 SEP 19:23Z
VICIdial Authenticated Remote Code Execution
cvelistv5