CVE-2025-34328

Description

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an unauthenticated script-management endpoint at AudioCodes_files/utils/IVR/diagram/ajaxScript.php. The saveScript action writes attacker-supplied data directly to a server-side file path under the privileges of the web service account, which runs as NT AUTHORITY\\SYSTEM on Windows deployments. A remote, unauthenticated attacker can write arbitrary files into the product’s web-accessible directory structure and subsequently execute them.

PUBLISHED Reserved 2025-04-15 | Published 2025-11-19 | Updated 2025-11-20 | Assigner VulnCheck

Problem types

CWE-434 Unrestricted Upload of File with Dangerous Type

Product status

Credits

Pierre Barre finder

References

www.audiocodes.com/...ocodes-auto-attendant-ivr-solution.pdf vendor-advisory patch mitigation

pierrekim.github.io/...ocodes-fax-ivr-8-vulnerabilities.html technical-description exploit

pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt technical-description exploit

www.vulncheck.com/...nticated-file-upload-rce-via-ajaxscript third-party-advisory

cve.org (CVE-2025-34328)

nvd.nist.gov (CVE-2025-34328)

Download JSON