Vulnerability in Audiocodes Fax Server
CVE-2025-34332
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component that controls back-end Windows services using helper batch scripts located under C:\\F2MAdmin\\F2E\\AudioCodes_files\\utils\\Services. When certain service actions are requested through ajaxPost.php, these scripts are invoked by PHP using system() under the NT AUTHORITY\\SYSTEM account. The batch files in this directory are writable by any authenticated local user due to overly permissive ACLs, allowing them to replace script contents with arbitrary commands. On the next service start/stop operation, the modified script is executed as SYSTEM, enabling elevation of local privileges.
EPSS: 0.002 (10.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- disclosure@vulncheck.com (Product, vendor-advisory, patch, mitigation)
- disclosure@vulncheck.com (Exploit, technical-description, Third Party Advisory, exploit)
- disclosure@vulncheck.com (Exploit, technical-description, Third Party Advisory, exploit)
- disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2025-34332?
- CVE-2025-34332 is a high-severity vulnerability in Audiocodes Fax Server, classified under Incorrect Default Permissions. CVSS score: 7.8/10. Published 2025-11-19.
- How severe is CVE-2025-34332?
- High severity. CVSS v3 base score is 7.8 out of 10.