An unauthenticated command injection flaw exists in VICIdial’s vicidial_sales_viewer.php when password encryption is enabled. The application forwards the Basic Authentication password directly to exec() without sanitization, allowing an attacker to embed arbitrary OS commands. Successful exploitation means the attacker can run any command as the web server user, compromising confidentiality, integrity, and availability of the affected system. The weakness is a classic input validation and OS command injection problem (CWE-20, CWE-78).

VICIdial, versions 2.9 RC1 through 2.13 RC1, with password encryption enabled. The vulnerability is present whenever the non‑default password encryption feature is active; it does not affect installations that have disabled this option.

The CVSS score of 9.3 reflects high severity. An EPSS score of 40% indicates a moderate likelihood of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog, but the combination of unauthenticated access and remote command execution makes it a significant risk. Attackers can exploit it remotely via HTTP Basic Authentication, forging the password field to inject commands. The vulnerability was reportedly mitigated in 2017, so older releases remain at risk.