CVE-2025-34332

Description

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component that controls back-end Windows services using helper batch scripts located under C:\\F2MAdmin\\F2E\\AudioCodes_files\\utils\\Services. When certain service actions are requested through ajaxPost.php, these scripts are invoked by PHP using system() under the NT AUTHORITY\\SYSTEM account. The batch files in this directory are writable by any authenticated local user due to overly permissive ACLs, allowing them to replace script contents with arbitrary commands. On the next service start/stop operation, the modified script is executed as SYSTEM, enabling elevation of local privileges.

PUBLISHED Reserved 2025-04-15 | Published 2025-11-19 | Updated 2025-11-20 | Assigner VulnCheck

Problem types

CWE-276 Incorrect Default Permissions

Product status

Credits

Pierre Barre finder

References

www.audiocodes.com/...ocodes-auto-attendant-ivr-solution.pdf vendor-advisory patch mitigation

pierrekim.github.io/...ocodes-fax-ivr-8-vulnerabilities.html technical-description exploit

pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt technical-description exploit

www.vulncheck.com/...ce-insecure-service-control-scripts-lpe third-party-advisory

cve.org (CVE-2025-34332)

nvd.nist.gov (CVE-2025-34332)

Download JSON