CVE-2025-34332

🗓️ 19 Nov 2025 16:23:27Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 3 Views🌐 WEB

AudioCodes Fax and IVR appliances up to 2.6.23 permit privilege escalation via writable service scripts

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-34332	19 Nov 202517:13	–	circl
CNNVD	AudioCodes Fax Server 安全漏洞	19 Nov 202500:00	–	cnnvd
Cvelist	CVE-2025-34332 AudioCodes Fax/IVR Appliance <= 2.6.23 Insecure Service Control Scripts LPE	19 Nov 202516:23	–	cvelist
EUVD	EUVD-2025-198203	19 Nov 202516:23	–	euvd
NVD	CVE-2025-34332	19 Nov 202517:15	–	nvd
Packet Storm	📄 AudioCodes Fax/IVR Appliance 2.6.23 File Upload / Code Execution / Privilege Escalation	20 Nov 202500:00	–	packetstorm
Packet Storm News	AudioCodes Fax/IVR Appliance 2.6.23 Scanner	21 Nov 202500:00	–	packetstormnews
Positive Technologies	PT-2025-47481	19 Nov 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-34332	20 Nov 202521:36	–	redhatcve
Vulnrichment	CVE-2025-34332 AudioCodes Fax/IVR Appliance <= 2.6.23 Insecure Service Control Scripts LPE	19 Nov 202516:23	–	vulnrichment

NVD

Vulners

CNA

Node

audiocodes fax_serverRange≤2.6.23

audiocodes interactive_voice_responseRange≤2.6.23

[
  {
    "defaultStatus": "unknown",
    "product": "AudioCodes Fax/IVR Appliance",
    "vendor": "AudioCodes Limited",
    "versions": [
      {
        "lessThanOrEqual": "2.6.23",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
pierrekim	www.pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html
vulncheck	www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-insecure-service-control-scripts-lpe
audiocodes	www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf
pierrekim	www.pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt

Parameter	Position	Path	Description	CWE
action	request body	AudioCodes_files/utils/IVR/diagram/ajaxScript.php	Unauthenticated write to server-side script leading to remote code execution via uploaded script	CWE-276
name	request body	AudioCodes_files/utils/IVR/diagram/ajaxScript.php	Unauthenticated write to server-side script leading to remote code execution via uploaded script	CWE-276
value	request body	AudioCodes_files/utils/IVR/diagram/ajaxScript.php	Unauthenticated write to server-side script leading to remote code execution via uploaded script	CWE-276
fileToUpload	upload data	AudioCodes_files/ajaxBackupUploadFile.php	Unauthenticated file upload to backup directory enabling webshell or arbitrary file placement	CWE-276
fileToUpload	upload data	AudioCodes_files/utils/IVR/diagram/ajaxPromptUploadFile.php	Unauthenticated file upload in IVR diagram area enabling arbitrary file placement	CWE-276
baseDir	query param	AudioCodes_files/download.php	Unauthenticated file download that can expose sensitive backups	CWE-276
f	query param	AudioCodes_files/download.php	Unauthenticated file download that can expose sensitive backups	CWE-276
serviceName	request body	AudioCodes_files/ajaxPost.php	Web-admin actions trigger system() calls for Windows services leading to privilege escalation	CWE-276
action	request body	AudioCodes_files/ajaxPost.php	Web-admin actions trigger system() calls for Windows services leading to privilege escalation	CWE-276
uploadedfile	upload data	AudioCodes_files/ActivateLicense.php	License upload path vulnerable to command execution via unsanitized filename/extension handling	CWE-276

11 Dec 2025 21:19Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.17.8

CVSS 48.5

EPSS0.00031

SSVC

CWE-276