TI-2013-06046 Aliases CVE-2013-7382 GHSA-f993-q56p-6c4w

VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier has a…

LOW 28CWE-255Published 2014-05-17 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Partial · None
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier has a hardcoded password of donotedit for the (1) VDAD and (2) VDCL users, which makes it easier for remote attackers to obtain access.

Why it matters now

EPSS 0.02675 85th percentileScored 2026-11-07

Public exploit Yes 3 exploit referencesTagged by NVD and the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:vicidial:vicidial::403a::::::*	up to 2.8	Vulnerable	VICIdial
cpe:2.3:a:vicidial:vicidial:2.7:-::::::	2.7	Vulnerable	VICIdial
cpe:2.3:a:vicidial:vicidial:2.7:rc1::::::	2.7 rc1	Vulnerable	VICIdial

cpe:2.3:a:vicidial:vicidial:*:403a:*:*:*:*:*:* Versions up to 2.8 Vulnerable ·VICIdial
cpe:2.3:a:vicidial:vicidial:2.7:-:*:*:*:*:*:* Versions 2.7 Vulnerable ·VICIdial
cpe:2.3:a:vicidial:vicidial:2.7:rc1:*:*:*:*:*:* Versions 2.7 rc1 Vulnerable ·VICIdial

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2013-7382
2026-10-03 Alias added: GHSA-f993-q56p-6c4w

References

Exploit 3

Other 1

https://adamcaudill.com/2013/10/23/vicidial-multiple-vulnerabilities/

TI-2013-03917 VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allows… CVSS 2.0MEDIUM 6.5
TI-2013-03916 Multiple SQL injection vulnerabilities in the agent interface (agc/) in VICIDIAL dialer… CVSS 2.0MEDIUM 6.5
TI-2022-15675 VICIDial 2.14b0.5 SVN 3550 was discovered to contain a SQL injection vulnerability at /vicidial/user_stats.php. CVSS 3.1HIGH 8.8
TI-2022-15674 SQL injection in VICIdial CVSS 3.1HIGH 8.8
TI-2022-15673 VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php. CVSS 3.1HIGH 8.8
TI-2022-15676 Cross-site scripting in VICIdial CVSS 3.1MEDIUM 6.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences