Vulnerability · Published Nov 19, 2025 · Assigned by VulnCheck
CVE-2025-34332AudioCodes Fax/IVR Appliance <= 2.6.23 Insecure Service Control Scripts LPE
High 8.5
In plain English
A high-severity incorrect default permissions in AudioCodes Fax/IVR Appliance from AudioCodes Limited. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component that controls back-end Windows services using helper batch scripts located under C:\\F2MAdmin\\F2E\\AudioCodes_files\\utils\\Services. When certain service actions are requested through ajaxPost.php, these scripts are invoked by PHP using system() under the NT AUTHORITY\\SYSTEM account. The batch files in this directory are writable by any authenticated local user due to overly permissive ACLs, allowing them to replace script contents with arbitrary commands. On the next service start/stop operation, the modified script is executed as SYSTEM, enabling elevation of local privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AudioCodes Limited | AudioCodes Fax/IVR Appliance | 0 – through 2.6.23 |
Weakness: CWE-276 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf vendor-advisory, patch, mitigation
- https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html technical-description, exploit
- https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt technical-description, exploit
- https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-insecure-service-control-scripts-lpe third-party-advisory