Arbitrary Shell Commands Execution Vulnerability
CVE-2024-8504

Currently unrated

Key Information:

Vendor

Vicidial

Status
Vendor
CVE Published:
10 September 2024

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 92%

What is CVE-2024-8504?

An authenticated user with 'agent' privileges in VICIdial can exploit a vulnerability to execute arbitrary shell commands with 'root' user permissions. This represents a significant security flaw that can be leveraged in conjunction with another identified vulnerability to escalate privileges from an unauthenticated perspective. Organizations utilizing VICIdial should prioritize implementing applicable patches and enhancing security measures to protect their systems from potential exploitation.

Affected Version(s)

VICIdial Linux 2.14-917a

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

References

EPSS Score

92% chance of being exploited in the next 30 days.

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

Credit

Jaggar Henry of KoreLogic, Inc.
.
CVE-2024-8504 : Arbitrary Shell Commands Execution Vulnerability