CVE-2025-34332
AudioCodes Fax/IVR Appliance <= 2.6.23 Insecure Service Control Scripts LPE
- State
- Published
- Severity
- 8.5 High
- Published
- Nov 19, 2025
- Updated
- Nov 20, 2025
- Reserved
- Apr 15, 2025
Description
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component that controls back-end Windows services using helper batch scripts located under C:\\F2MAdmin\\F2E\\AudioCodes_files\\utils\\Services. When certain service actions are requested through ajaxPost.php, these scripts are invoked by PHP using system() under the NT AUTHORITY\\SYSTEM account. The batch files in this directory are writable by any authenticated local user due to overly permissive ACLs, allowing them to replace script contents with arbitrary commands. On the next service start/stop operation, the modified script is executed as SYSTEM, enabling elevation of local privileges.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.5 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-276 Incorrect Default Permissions
Affected Products
| Product | Versions |
|---|---|
AudioCodes Fax/IVR ApplianceAudioCodes Limited |
|
References
- https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdfvendor-advisorypatchmitigation
- https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.htmltechnical-descriptionexploit
- https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txttechnical-descriptionexploit
- https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-insecure-service-control-scripts-lpethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.