CVE-2024-8504

2024-09-1020:15:05

CWE-78

KoreLogic

web.nvd.nist.gov

vicidial

authenticated access

agent

arbitrary shell commands

root user

chained attack

unauthenticated perspective

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.003

Percentile

65.6%

JSON

An attacker with authenticated access to VICIdial as an “agent” can execute arbitrary shell commands as the “root” user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "VICIdial",
    "vendor": "VICIdial",
    "versions": [
      {
        "status": "affected",
        "version": "2.14-917a"
      }
    ]
  }
]