CVE-2025-34333
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
AudioCodes Fax Server and Auto-Attendant IVR appliances up to and including 2.6.23 configure the web document root C:\F2MAdmin\F2E with overly permissive file system permissions. Authenticated local users have modify rights while the web server runs as NT AUTHORITY\SYSTEM, allowing creation or alteration of server-side scripts that execute with SYSTEM privileges.
Risk Assessment
A local user can gain full control of the appliance by injecting a malicious script into the webroot, leading to code execution as SYSTEM.
Recommendation
Restrict permissions on the webroot and update the appliance to a patched version.
Other vulnerabilities in AudioCodes Fax Server / Auto-Attendant IVR
See all- CVE-2025-34334High
AudioCodes Fax Server and Auto-Attendant IVR up to and including 2.6.23 are vulnerable to authenticated command injection in the fax test functionality (TestFax.php). An authenticated attacker can inject additional shell commands into the generated batch file, which is executed with SYSTEM privileges, leading to arbitrary command execution. Additionally, overly permissive file permissions allow a local low-privilege user to modify pending batch files for privilege escalation.
- CVE-2025-34332High
AudioCodes Fax Server and Auto-Attendant IVR appliances up to and including 2.6.23 include a web administration component that invokes helper batch scripts under C:\F2MAdmin\F2E\AudioCodes_files\utils\Services as NT AUTHORITY\SYSTEM. These batch files are writable by any authenticated local user due to overly permissive ACLs, allowing replacement with arbitrary commands that execute as SYSTEM on the next service operation.
- CVE-2025-34331High
AudioCodes Fax Server and Auto-Attendant IVR appliances up to version 2.6.23 contain an unauthenticated file read vulnerability via the download.php script. The endpoint lacks access control, allowing remote unauthenticated users to request files based on attacker-supplied path and filename parameters.
Original NVD description (English source)
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 configure the web document root at C:\\F2MAdmin\\F2E with overly permissive file system permissions. Authenticated local users have modify rights on this directory, while the associated web server process runs as NT AUTHORITY\\SYSTEM. As a result, any local user can create or alter server-side scripts within the webroot and then trigger them via HTTP requests, causing arbitrary code to execute with SYSTEM privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS