CVE-2025-34329
CriticalSummary
AudioCodes Fax Server and Auto-Attendant IVR appliances up to version 2.6.23 expose an unauthenticated backup upload endpoint in the F2MAdmin interface. The script creates a directory and moves an uploaded file with an attacker-controlled filename without authentication or file-type validation. On default Windows deployments, an attacker can upload configuration files leading to arbitrary command execution as NT AUTHORITY\SYSTEM.
Risk Assessment
Full remote compromise of the server by an unauthenticated attacker, potentially leading to data theft, system modification, and further network attacks.
Recommendation
Update the software to the latest version if available, and restrict access to the F2MAdmin interface to trusted networks. Additionally, implement authentication and file validation on this endpoint.
Other vulnerabilities in AudioCodes Fax Server
Original NVD description (English source)
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodes_files/ajaxBackupUploadFile.php in the F2MAdmin web interface. The script derives a backup folder path from application configuration, creates the directory if it does not exist, and then moves an uploaded file to that location using the attacker-controlled filename, without any authentication, authorization, or file-type validation. On default Windows deployments where the backup directory resolves to the system drive, a remote attacker can upload web server or interpreter configuration files that cause a log file or other server-controlled resource to be treated as executable code. This allows subsequent HTTP requests to trigger arbitrary command execution under the web server account, which runs as NT AUTHORITY\\SYSTEM.