AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component that controls back-end Windows services using helper batch scripts located under C:\\F2MAdmin\\F2E\\AudioCodes_files\\utils\\Services. When certain service actions are requested through ajaxPost.php, these scripts are invoked by PHP using system() under the NT AUTHORITY\\SYSTEM account. The batch files in this directory are writable by any authenticated local user due to overly permissive ACLs, allowing them to replace script contents with arbitrary commands. On the next service start/stop operation, the modified script is executed as SYSTEM, enabling elevation of local privileges.
References
| Link | Resource |
|---|---|
| https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt | Exploit Third Party Advisory |
| https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html | Exploit Third Party Advisory |
| https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf | Product |
| https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-insecure-service-control-scripts-lpe | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
11 Dec 2025, 21:19
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt - Exploit, Third Party Advisory | |
| References | () https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html - Exploit, Third Party Advisory | |
| References | () https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf - Product | |
| References | () https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-insecure-service-control-scripts-lpe - Third Party Advisory | |
| First Time |
Audiocodes interactive Voice Response
Audiocodes Audiocodes fax Server |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| CPE | cpe:2.3:a:audiocodes:fax_server:*:*:*:*:*:*:*:* cpe:2.3:a:audiocodes:interactive_voice_response:*:*:*:*:*:*:*:* |
19 Nov 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-19 17:15
Updated : 2025-12-11 21:19
NVD link : CVE-2025-34332
Mitre link : CVE-2025-34332
CVE.ORG link : CVE-2025-34332
JSON object : View
Products Affected
audiocodes
- interactive_voice_response
- fax_server
CWE
CWE-276
Incorrect Default Permissions