PT-2025-29141

CVE-2025-34099

Published

2025-07-10

Updated

2025-11-07

Description by

CVSS 4.0

9.3

Critical

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: VICIdial versions 2.9 RC1 through 2.13 RC1

Description: An unauthenticated command injection issue exists in the vicidial sales viewer.php component when password encryption is enabled. The application improperly passes the HTTP Basic Authentication password to a call to exec() without adequate sanitation, allowing remote attackers to inject and execute arbitrary operating system commands as the web server user.

Recommendations: VICIdial versions 2.9 RC1 through 2.13 RC1: Disable password encryption to mitigate the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

CWE-20: Improper Input Validation

Related identifiers