AudioCodes Fax Server / Auto-Attendant IVR vulnerabilities

AudioCodes Fax Server and Auto-Attendant IVR up to and including 2.6.23 are vulnerable to authenticated command injection in the fax test functionality (TestFax.php). An authenticated attacker can inject additional shell commands into the generated batch file, which is executed with SYSTEM privileges, leading to arbitrary command execution. Additionally, overly permissive file permissions allow a local low-privilege user to modify pending batch files for privilege escalation.

AudioCodes Fax Server and Auto-Attendant IVR appliances up to and including 2.6.23 configure the web document root C:\F2MAdmin\F2E with overly permissive file system permissions. Authenticated local users have modify rights while the web server runs as NT AUTHORITY\SYSTEM, allowing creation or alteration of server-side scripts that execute with SYSTEM privileges.

AudioCodes Fax Server and Auto-Attendant IVR appliances up to and including 2.6.23 include a web administration component that invokes helper batch scripts under C:\F2MAdmin\F2E\AudioCodes_files\utils\Services as NT AUTHORITY\SYSTEM. These batch files are writable by any authenticated local user due to overly permissive ACLs, allowing replacement with arbitrary commands that execute as SYSTEM on the next service operation.

AudioCodes Fax Server and Auto-Attendant IVR appliances up to version 2.6.23 contain an unauthenticated file read vulnerability via the download.php script. The endpoint lacks access control, allowing remote unauthenticated users to request files based on attacker-supplied path and filename parameters.