What’s Vulnerable › Vulnerabilities

CVE-2024-8504: VICIdial Authenticated Remote Code Execution

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 76.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-10 · updated 2026-06-17
• Weakness: CWE-78

Description

An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective.

Affected products

• VICIdial: 2.14-917a

References

• https://korelogic.com/Resources/Advisories/KL-001-2024-012.txt
• https://www.vicidial.org/vicidial.php
• http://seclists.org/fulldisclosure/2024/Sep/26

Get alerted when CVE-2024-8504 or the next vulnerability affects your stack