Arbitrary Shell Commands Execution Vulnerability
CVE-2024-8504

8.8HIGH

Key Information:

Vendor

Vicidial

Status
Vicidial
Vendor
CVE Published:
10 September 2024

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 92%

What is CVE-2024-8504?

An authenticated user with 'agent' privileges in VICIdial can exploit a vulnerability to execute arbitrary shell commands with 'root' user permissions. This represents a significant security flaw that can be leveraged in conjunction with another identified vulnerability to escalate privileges from an unauthenticated perspective. Organizations utilizing VICIdial should prioritize implementing applicable patches and enhancing security measures to protect their systems from potential exploitation.

Affected Version(s)

VICIdial Linux 2.14-917a

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-8504
Created by Chocapikk

ViciDial
Created by havokzero

References

https://korelogic.com/Resources/Advisories/KL-001-2024-01...
third-party-advisory
https://www.vicidial.org/vicidial.php
product

EPSS Score

92% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

Credit

Jaggar Henry of KoreLogic, Inc.
JSON
.