Audiocodes
33 CVEs across 45 Audiocodes products. Browse Audiocodes vulnerabilities, severities, and proof-of-concept exploits.
Audiocodes products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-34335 | High | 8.8 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an authenticated command injection vulnerability in the lice… |
CVE-2025-34334 | High | 8.8 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 are vulnerable to an authenticated command injection in the fax tes… |
CVE-2025-34333 | High | 7.8 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 configure the web document root at C:\\F2MAdmin\\F2E with overly pe… |
CVE-2025-34332 | High | 7.8 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component that controls back-end Windo… |
CVE-2025-34331 | High | 7.5 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 contain an unauthenticated file read vulnerability via the download… |
CVE-2025-34330 | Medium | 5.3 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an u… |
CVE-2025-34329 | Critical | 9.8 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodes_file… |
CVE-2025-34328 | Critical | 9.8 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an u… |
CVE-2025-32106 | Critical | 9.8 | 2025-06-03 | In Audiocodes Mediapack MP-11x through 6.60A.369.002, a crafted POST request request may result in an unauthenticated remote user's ability to execute unauthor… |
CVE-2024-52884 | High | 7.5 | 2025-02-07 | An issue was discovered in AudioCodes Mediant Session Border Controller (SBC) before 7.40A.501.841. Due to the use of weak password obfuscation/encryption, an… |
CVE-2024-52883 | High | 7.5 | 2025-02-07 | An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to a path traversal vulnerability, sensitive data can be read with… |
CVE-2024-52882 | Medium | 6.1 | 2025-02-07 | An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to improper neutralization of input via the devices API, an attack… |
CVE-2024-52881 | High | 7.5 | 2025-02-07 | An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to the use of a hard-coded key, an attacker is able to decrypt sen… |
CVE-2023-22957 | High | 7.5 | 2023-08-11 | An issue was discovered in libac_des3.so on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of hard-coded cryptographic key, an attacker with ac… |
CVE-2023-22956 | High | 7.5 | 2023-08-11 | An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of a hard-coded cryptographic key, an attacker is able to decrypt enc… |
CVE-2023-22955 | High | 7.8 | 2023-08-11 | An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. The validation of firmware images only consists of simple checksum checks for differ… |
CVE-2022-24632 | Medium | 5.3 | 2023-05-29 | An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is directory traversal during file download via the BrowseFiles.php vi… |
CVE-2022-24631 | Medium | 5.4 | 2023-05-29 | An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is stored XSS via the ajaxTenants.php desc parameter. |
CVE-2022-24630 | High | 7.2 | 2023-05-29 | An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. BrowseFiles.php allows a ?cmd=ssh POST request with an ssh_command field… |
CVE-2022-24629 | Critical | 9.8 | 2023-05-29 | An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achieved via directory traversal in the dir… |
CVE-2022-24628 | High | 7.2 | 2023-05-29 | An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is authenticated SQL injection in the id parameter of IPPhoneFirmwareE… |
CVE-2022-24627 | Critical | 9.8 | 2023-05-29 | An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the process_… |
CVE-2019-9229 | High | 8.8 | 2019-07-20 | An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.251. An internal in… |
CVE-2019-9228 | High | 7.5 | 2019-07-19 | An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A at least to 7.20A.252.062. Th… |
CVE-2019-9231 | High | 8.8 | 2019-07-18 | An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions before 7.20A.202.307. A Cross-Site R… |
CVE-2019-9230 | Medium | 6.1 | 2019-07-18 | An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.253. A cross-site s… |
CVE-2018-16220 | Medium | 6.1 | 2019-04-25 | Cross Site Scripting in different input fields (domain field and personal settings) in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an attacker (loc… |
CVE-2018-16219 | High | 8.8 | 2019-04-25 | A missing password verification in the web interface in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an remote attacker (in the same network as the… |
CVE-2018-16216 | High | 8.0 | 2019-04-25 | A command injection (missing input validation, escaping) in the monitoring or memory status web interface in AudioCodes 405HD (firmware 2.2.12) VoIP phone allo… |
CVE-2018-5757 | High | 8.8 | 2019-04-01 | An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a re… |
CVE-2018-10093 | High | 8.8 | 2019-03-21 | AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution. |
CVE-2018-10091 | Medium | 4.8 | 2019-03-21 | AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow XSS. |
CVE-2018-18567 | Medium | 5.9 | 2018-10-24 | AudioCodes 440HD and 450HD devices 3.1.2.89 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by leveraging failure to… |