This vulnerability involves improper neutralization of special elements in an OS command context (CWE-78) within VICIdial's vicidial_sales_viewer.php when password encryption is enabled. The application directly uses the HTTP Basic Authentication password in an exec() system call without adequate sanitization, enabling unauthenticated remote attackers to inject and execute arbitrary commands on the server. The affected versions are 2.9 RC1 through 2.13 RC1. Although the vulnerability was publicly documented in 2025, it was mitigated by the vendor in 2017. No patch links are provided, and the product is not a cloud service, so remediation depends on upgrading or applying vendor fixes from the mitigation timeframe.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary operating system commands with the privileges of the web server user. This can lead to full system compromise, data theft, or disruption of service. The vulnerability is critical due to its high CVSS score (9.3) and lack of required authentication for exploitation. However, the vendor mitigated this issue in 2017, reducing the risk for updated deployments.

The vulnerability was mitigated by the vendor in 2017. Users should ensure they are running a version of VICIdial later than 2.13 RC1 or have applied the vendor's mitigation from that time. Since no official patch links are provided, verifying with the vendor's advisory or upgrading to a fixed version is recommended. No additional action is required if the mitigation is already applied.