VulnerabilityDeferred

CVE-2024-8504

An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user.

HIGH 8.8EPSS 76.2%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 76.2%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.

Description

An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 76.22% probability · 100th percentile
CISA KEV: Not listed
Weakness: CWE-78
Source: bbf0bd87-ece2-41be-b873-96928ee8fab9

References

https://korelogic.com/Resources/Advisories/KL-001-2024-012.txt
https://www.vicidial.org/vicidial.php
http://seclists.org/fulldisclosure/2024/Sep/26

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.