CVE-2013-7382

VICIDIAL dialer <2.8-403a, 2.7, 2.7RC1 - Info Disclosure

Title source: llm

Description

VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier has a hardcoded password of donotedit for the (1) VDAD and (2) VDCL users, which makes it easier for remote attackers to obtain access.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Metasploit · rubyremotelinux

https://www.exploit-db.com/exploits/29513

View Code ZIP pw:eip

References (4)

[Various Sources] https://adamcaudill.com/2013/10/23/vicidial-multiple-vulnerabilities/

[Exploit] http://www.openwall.com/lists/oss-security/2013/10/23/10

[Exploit] http://www.openwall.com/lists/oss-security/2013/10/25/1

[Exploit] http://www.exploit-db.com/exploits/29513

Scores

EPSS 0.0674

EPSS Percentile 91.3%

Details

CWE

CWE-255

Status published

Products (2)

vicidial/vicidial 2.7 (2 CPE variants)

vicidial/vicidial < 2.8

Published May 17, 2014

Tracked Since Feb 18, 2026