CVE-2025-34328

Critical

Published: 19/11/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

AudioCodes Fax Server and Auto-Attendant IVR appliances up to version 2.6.23 include a web administration component with an unauthenticated script-management endpoint. The saveScript action writes attacker-supplied data directly to a server-side file path under the privileges of the web service account, which runs as NT AUTHORITY\SYSTEM on Windows. An unauthenticated remote attacker can write arbitrary files into the web-accessible directory and execute them.

Risk Assessment

Full device compromise by a remote attacker, allowing execution of malicious code with highest system privileges.

Recommendation

Update the software to the latest version if available, and restrict access to the F2MAdmin interface. Implement authentication and input validation on this endpoint.

Other vulnerabilities in AudioCodes Fax Server

CVE-2025-34329Critical
AudioCodes Fax Server and Auto-Attendant IVR appliances up to version 2.6.23 expose an unauthenticated backup upload endpoint in the F2MAdmin interface. The script creates a directory and moves an uploaded file with an attacker-controlled filename without authentication or file-type validation. On default Windows deployments, an attacker can upload configuration files leading to arbitrary command execution as NT AUTHORITY\SYSTEM.

Original NVD description (English source)

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an unauthenticated script-management endpoint at AudioCodes_files/utils/IVR/diagram/ajaxScript.php. The saveScript action writes attacker-supplied data directly to a server-side file path under the privileges of the web service account, which runs as NT AUTHORITY\\SYSTEM on Windows deployments. A remote, unauthenticated attacker can write arbitrary files into the product’s web-accessible directory structure and subsequently execute them.