CVE-2025-34330mediumCWE-434

CVE-2025-34330: medium-severity vulnerability in AudioCodes Fax/IVR Appliance

AudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated Prompt File Upload via ajaxPromptUploadFile.php

Published · Updated

Follow this CVE+ Monitor AudioCodes Fax/IVR Appliance

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.5%
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an unauthenticated prompt upload endpoint at AudioCodes_files/utils/IVR/diagram/ajaxPromptUploadFile.php. The script accepts an uploaded file and writes it into the C:\\F2MAdmin\\tmp directory using a filename derived from application constants, without any authentication, authorization, or file-type validation. A remote, unauthenticated attacker can upload or overwrite prompt- or music-on-hold–related files in this directory, potentially leading to tampering with IVR audio content or preparing files for use in further attacks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
AudioCodes Limited · AudioCodes Fax/IVR Appliance
Related CVEs — AudioCodes Fax/IVR Appliance

In the same product, most dangerous first.

CVE-2025-34334HIGHAudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via TestFax.php & LPEEPSS 3.4%CVE-2025-34335HIGHAudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via ActivateLicense.phpEPSS 2.8%CVE-2025-34329CRITICALAudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated Backup Upload RCE via ajaxBackupUploadFile.phpEPSS 1.2%CVE-2025-34328CRITICALAudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated File Upload RCE via ajaxScript.phpEPSS 0.8%CVE-2025-34331HIGHAudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated File Read via download.phpEPSS 0.6%CVE-2025-34332HIGHAudioCodes Fax/IVR Appliance <= 2.6.23 Insecure Service Control Scripts LPEEPSS 0.2%