CVE-2024-8504

CVE-2024-8504 is an OS command injection flaw (CWE-78) in VICIdial, the open-source, Asterisk-based contact center and predictive dialer suite, in which an attacker logged in with any agent-level account can execute arbitrary shell commands on the server as the root user. The attacker triggers it by supplying crafted input from the authenticated agent interface that is passed unsafely to the underlying shell. Because the commands run as root, successful exploitation yields full server compromise, including access to call records, recordings and customer data, and potentially the telephony infrastructure itself. Any VICIdial deployment is affected, and the flaw can be chained with CVE-2024-8503 to achieve unauthenticated root command execution. No public proof-of-concept is known and it is not yet in CISA KEV, but EPSS of 76.2% (100th percentile) indicates a very high predicted likelihood of exploitation within 30 days.

What to do: Upgrade VICIdial to a release published in 2024 or later that contains the fixes for both CVE-2024-8504 and the chainable CVE-2024-8503, since chaining removes the need for valid agent credentials. Until patched, restrict network access to the VICIdial agent web interface and expose it only to trusted agent networks, prioritizing any internet-exposed servers. Check server logs for unexpected commands or processes run as root and review agent account usage for signs of prior exploitation.