CVE-2025-34099CWE-20CWE-78

VICIdial vicidial_sales_viewer.php Unauthenticated Command Injection via Basic Auth Password

Critical · published July 10, 2025

CVSS v4.0
9.3
EPSS
2%
Percentile
76.2
In the wild
Unconfirmed
What it is

An unauthenticated command injection vulnerability exists in VICIdial versions 2.9 RC1 through 2.13 RC1, within the vicidial_sales_viewer.php component when password encryption is enabled (a non-default configuration). The application improperly passes the HTTP Basic Authentication password directly to a call to exec() without adequate sanitation. This allows remote attackers to inject and execute arbitrary operating system commands as the web server user. NOTE: This vulnerability was mitigated in 2017.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01644 · 76.2th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-07-10T19:10Z
EPSS history
Timeline
  • 10 JUL 19:10Z
    VICIdial vicidial_sales_viewer.php Unauthenticated Command Injection via Basic Auth Password
    cvelistv5