CVE-2025-34334
HighCVSS 8.8Exploitation Probability (EPSS)
High risk89th percentile - higher than 89% of all known CVEs
Summary
AudioCodes Fax Server and Auto-Attendant IVR up to and including 2.6.23 are vulnerable to authenticated command injection in the fax test functionality (TestFax.php). An authenticated attacker can inject additional shell commands into the generated batch file, which is executed with SYSTEM privileges, leading to arbitrary command execution. Additionally, overly permissive file permissions allow a local low-privilege user to modify pending batch files for privilege escalation.
Risk Assessment
An attacker could execute arbitrary commands with SYSTEM privileges, taking control of the server. A local user could also elevate privileges.
Recommendation
Update AudioCodes software to a version later than 2.6.23. Restrict access to the fax test interface and fix file system permissions.
Other vulnerabilities in AudioCodes Fax Server / Auto-Attendant IVR
See all- CVE-2025-34333High
AudioCodes Fax Server and Auto-Attendant IVR appliances up to and including 2.6.23 configure the web document root C:\F2MAdmin\F2E with overly permissive file system permissions. Authenticated local users have modify rights while the web server runs as NT AUTHORITY\SYSTEM, allowing creation or alteration of server-side scripts that execute with SYSTEM privileges.
- CVE-2025-34332High
AudioCodes Fax Server and Auto-Attendant IVR appliances up to and including 2.6.23 include a web administration component that invokes helper batch scripts under C:\F2MAdmin\F2E\AudioCodes_files\utils\Services as NT AUTHORITY\SYSTEM. These batch files are writable by any authenticated local user due to overly permissive ACLs, allowing replacement with arbitrary commands that execute as SYSTEM on the next service operation.
- CVE-2025-34331High
AudioCodes Fax Server and Auto-Attendant IVR appliances up to version 2.6.23 contain an unauthenticated file read vulnerability via the download.php script. The endpoint lacks access control, allowing remote unauthenticated users to request files based on attacker-supplied path and filename parameters.
Original NVD description (English source)
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 are vulnerable to an authenticated command injection in the fax test functionality implemented by AudioCodes_files/TestFax.php. When a fax "send" test is requested, the application builds a faxsender command line using attacker-supplied parameters and passes it to GlobalUtils::RunBatchFile without proper validation or shell-argument sanitization. The resulting batch file is written into a temporary run directory and then executed via a backend service that runs as NT AUTHORITY\\SYSTEM. An authenticated attacker with access to the fax test interface can craft parameter values that inject additional shell commands into the generated batch file, leading to arbitrary command execution with SYSTEM privileges. In addition, because the generated batch files reside in a location with overly permissive file system permissions, a local low-privilege user on the server can modify pending batch files to achieve the same elevation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS