This vulnerability (CVE-2025-34099) affects VICIdial versions 2.9 RC1 through 2.13 RC1 when password encryption is enabled. The issue is in the vicidial_sales_viewer.php component, where the HTTP Basic Authentication password is passed unsanitized to the exec() system call. This improper neutralization of special elements (CWE-78) enables unauthenticated remote attackers to inject and execute arbitrary OS commands with the privileges of the web server user. The vulnerability was mitigated in 2017, prior to its public disclosure in 2025.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary operating system commands as the web server user, which can lead to full system compromise depending on the server's privileges. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

This vulnerability was mitigated in 2017. Users should ensure they are running a version of VICIdial that includes this mitigation or later. Since no official patch links are provided and the vulnerability is mitigated, no further action is required if using a version released after 2017. For affected versions, upgrading to a fixed version is recommended. Patch status is not explicitly confirmed in the provided data; verify with the vendor advisory for current remediation guidance.