CVE-2025-34332
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
AudioCodes Fax Server and Auto-Attendant IVR appliances up to and including 2.6.23 include a web administration component that invokes helper batch scripts under C:\F2MAdmin\F2E\AudioCodes_files\utils\Services as NT AUTHORITY\SYSTEM. These batch files are writable by any authenticated local user due to overly permissive ACLs, allowing replacement with arbitrary commands that execute as SYSTEM on the next service operation.
Risk Assessment
A local user can escalate privileges to SYSTEM by modifying service scripts, leading to full appliance compromise.
Recommendation
Restrict permissions on the service scripts directory and update the appliance to a patched version.
Other vulnerabilities in AudioCodes Fax Server / Auto-Attendant IVR
See all- CVE-2025-34334High
AudioCodes Fax Server and Auto-Attendant IVR up to and including 2.6.23 are vulnerable to authenticated command injection in the fax test functionality (TestFax.php). An authenticated attacker can inject additional shell commands into the generated batch file, which is executed with SYSTEM privileges, leading to arbitrary command execution. Additionally, overly permissive file permissions allow a local low-privilege user to modify pending batch files for privilege escalation.
- CVE-2025-34333High
AudioCodes Fax Server and Auto-Attendant IVR appliances up to and including 2.6.23 configure the web document root C:\F2MAdmin\F2E with overly permissive file system permissions. Authenticated local users have modify rights while the web server runs as NT AUTHORITY\SYSTEM, allowing creation or alteration of server-side scripts that execute with SYSTEM privileges.
- CVE-2025-34331High
AudioCodes Fax Server and Auto-Attendant IVR appliances up to version 2.6.23 contain an unauthenticated file read vulnerability via the download.php script. The endpoint lacks access control, allowing remote unauthenticated users to request files based on attacker-supplied path and filename parameters.
Original NVD description (English source)
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component that controls back-end Windows services using helper batch scripts located under C:\\F2MAdmin\\F2E\\AudioCodes_files\\utils\\Services. When certain service actions are requested through ajaxPost.php, these scripts are invoked by PHP using system() under the NT AUTHORITY\\SYSTEM account. The batch files in this directory are writable by any authenticated local user due to overly permissive ACLs, allowing them to replace script contents with arbitrary commands. On the next service start/stop operation, the modified script is executed as SYSTEM, enabling elevation of local privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS