Vulnerability Description
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component that controls back-end Windows services using helper batch scripts located under C:\\F2MAdmin\\F2E\\AudioCodes_files\\utils\\Services. When certain service actions are requested through ajaxPost.php, these scripts are invoked by PHP using system() under the NT AUTHORITY\\SYSTEM account. The batch files in this directory are writable by any authenticated local user due to overly permissive ACLs, allowing them to replace script contents with arbitrary commands. On the next service start/stop operation, the modified script is executed as SYSTEM, enabling elevation of local privileges.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Audiocodes | Fax Server | <= 2.6.23 |
| Audiocodes | Interactive Voice Response | <= 2.6.23 |
Related Weaknesses (CWE)
References
- https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txtExploitThird Party Advisory
- https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilitiesExploitThird Party Advisory
- https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-forProduct
- https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-insecure-serviThird Party Advisory
FAQ
What is CVE-2025-34332?
CVE-2025-34332 is a vulnerability with a CVSS score of 7.8 (HIGH). AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component that controls back-end Windows services using helper batch scripts lo...
How severe is CVE-2025-34332?
CVE-2025-34332 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-34332?
Check the references section above for vendor advisories and patch information. Affected products include: Audiocodes Fax Server, Audiocodes Interactive Voice Response.