CVE-2025-34332highCWE-276

CVE-2025-34332: high-severity vulnerability in AudioCodes Fax/IVR Appliance

AudioCodes Fax/IVR Appliance <= 2.6.23 Insecure Service Control Scripts LPE

Published · Updated

Follow this CVE+ Monitor AudioCodes Fax/IVR Appliance

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5epss 0.2%
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component that controls back-end Windows services using helper batch scripts located under C:\\F2MAdmin\\F2E\\AudioCodes_files\\utils\\Services. When certain service actions are requested through ajaxPost.php, these scripts are invoked by PHP using system() under the NT AUTHORITY\\SYSTEM account. The batch files in this directory are writable by any authenticated local user due to overly permissive ACLs, allowing them to replace script contents with arbitrary commands. On the next service start/stop operation, the modified script is executed as SYSTEM, enabling elevation of local privileges.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
AudioCodes Limited · AudioCodes Fax/IVR Appliance
Related CVEs — AudioCodes Fax/IVR Appliance

In the same product, most dangerous first.

CVE-2025-34334HIGHAudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via TestFax.php & LPEEPSS 3.4%CVE-2025-34335HIGHAudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via ActivateLicense.phpEPSS 2.8%CVE-2025-34329CRITICALAudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated Backup Upload RCE via ajaxBackupUploadFile.phpEPSS 1.2%CVE-2025-34328CRITICALAudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated File Upload RCE via ajaxScript.phpEPSS 0.8%CVE-2025-34331HIGHAudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated File Read via download.phpEPSS 0.6%CVE-2025-34330MEDIUMAudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated Prompt File Upload via ajaxPromptUploadFile.phpEPSS 0.5%