Back to Database
Status published
Unknown
CVE-2024-8504
VICIdial Authenticated Remote Code Execution
Vulnerability Description
An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-8504
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Jaggar Henry of KoreLogic, Inc.
References
More from VICIdial
View All →CVE-2024-8503
VICIdial Unauthenticated SQL Injection
Unknown
0
CVE-2022-34879
VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple Cross Site Scripting (XSS) vulnerabilities at /vicidial/admin.php.
Medium
6.5
CVE-2022-34878
VICIDial 2.14b0.5 SVN 3550 was discovered to contain a SQL injection vulnerability at /vicidial/user_stats.php.
Medium
5.5
CVE-2022-34877
VICIDial 2.14b0.5 SVN 3550 was discovered to contains a SQL injection vulnerability at /vicidial/AST_agent_time_sheet.php.
Medium
6.4
CVE-2022-34876
VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php.
Medium
5.5
Affected Vendor
VICIdial
View all reports →Affected Software
VICIdial
Vulnerable Versions:
2.14-917a
Timeline
Official Publish:
September 10th, 2024
Last Modified:
November 4th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
No vector data available