Security readout for executives and security teams
Plain-English summary
This is a reported cross-site scripting issue in specific VICIdial builds. An attacker may be able to make the VICIdial web interface run attacker-controlled script in a user's browser. That can expose session data or trigger actions as that user. The public record does not provide severity, CVSS, or confirmed exploitation.
Executive priority
Treat as a version-specific web application risk with uncertain severity. Prioritize inventory and vendor patch verification, especially for externally reachable VICIdial systems used by agents or administrators.
Technical view
The CVE describes XSS in VICIdial v2.14-610c and v2.10-415c involving parameters on /agc/vicidial.php, agc/vicidial-greay.php, and /vicidial/KHOMP_admin.php. Sources do not provide payload details, authentication requirements, CVSS, or fixed versions. Treat this as browser-executed script risk, not confirmed server-side code execution.
Likely exposure
Organizations running VICIdial v2.14-610c or v2.10-415c are the only exposed cases named in the supplied sources. Publicly reachable agent or administration interfaces would increase concern, but exposure details are not provided.
Exploitation context
The source bundle does not show CISA KEV listing or any cited evidence of active exploitation. Public details are sparse and do not establish exploit maturity, required privileges, or whether user interaction is required.
Researcher notes
The record is thin: no CVSS, CWE, CPE, patch version, exploit prerequisites, or proof details are supplied. The description's “arbitrary code” wording should be interpreted cautiously because the vulnerability class is XSS.
Mitigation direction
- Inventory VICIdial instances and identify exact deployed versions.
- Check VICIdial vendor guidance or forum updates for fixed builds or patches.
- Restrict VICIdial web access to trusted networks or VPN where operationally feasible.
- Review web application firewall rules for generic XSS protections.
- Prioritize remediation for internet-facing agent or admin portals.
Validation and detection
- Confirm whether any instance runs VICIdial v2.14-610c or v2.10-415c.
- Identify whether the named PHP paths are reachable by untrusted users.
- Review access logs for unusual requests to the named paths.
- Verify current vendor release notes or guidance before declaring remediation complete.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-35377 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=2&t=41634CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.