CVE-2025-34331
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
AudioCodes Fax Server and Auto-Attendant IVR appliances up to version 2.6.23 contain an unauthenticated file read vulnerability via the download.php script. The endpoint lacks access control, allowing remote unauthenticated users to request files based on attacker-supplied path and filename parameters.
Risk Assessment
Sensitive backup archives may be retrieved, exposing internal databases, administrative password hashes, and other sensitive configuration data.
Recommendation
Restrict access to download.php, implement authentication and authorization, and update the software to a patched version.
Other vulnerabilities in AudioCodes Fax Server / Auto-Attendant IVR
See all- CVE-2025-34334High
AudioCodes Fax Server and Auto-Attendant IVR up to and including 2.6.23 are vulnerable to authenticated command injection in the fax test functionality (TestFax.php). An authenticated attacker can inject additional shell commands into the generated batch file, which is executed with SYSTEM privileges, leading to arbitrary command execution. Additionally, overly permissive file permissions allow a local low-privilege user to modify pending batch files for privilege escalation.
- CVE-2025-34333High
AudioCodes Fax Server and Auto-Attendant IVR appliances up to and including 2.6.23 configure the web document root C:\F2MAdmin\F2E with overly permissive file system permissions. Authenticated local users have modify rights while the web server runs as NT AUTHORITY\SYSTEM, allowing creation or alteration of server-side scripts that execute with SYSTEM privileges.
- CVE-2025-34332High
AudioCodes Fax Server and Auto-Attendant IVR appliances up to and including 2.6.23 include a web administration component that invokes helper batch scripts under C:\F2MAdmin\F2E\AudioCodes_files\utils\Services as NT AUTHORITY\SYSTEM. These batch files are writable by any authenticated local user due to overly permissive ACLs, allowing replacement with arbitrary commands that execute as SYSTEM on the next service operation.
Original NVD description (English source)
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 contain an unauthenticated file read vulnerability via the download.php script. The endpoint exposes a file download mechanism that lacks access control, allowing remote, unauthenticated users to request files stored on the appliance based solely on attacker-supplied path and filename parameters. While limited to specific file extensions permitted by the application logic, sensitive backup archives can be retrieved, exposing internal databases and credential hashes. Successful exploitation may lead to disclosure of administrative password hashes and other sensitive configuration data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS