Vulnerability · Published Sep 10, 2024 · Assigned by KoreLogic
CVE-2024-8504VICIdial Authenticated Remote Code Execution
High 8.8
In plain English
A high-severity OS command injection in VICIdial from VICIdial. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 76.2% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)76.2%top 0.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling2Metasploit, Public PoC
Official description
An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H