CVE-2025-34334

🗓️ 19 Nov 2025 16:23:47Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 21 Views🌐 WEB

CVE-2025-34334: Authenticated command injection in AudioCodes Fax/IVR up to 2.6.23 via TestFax.php enabling SYSTEM access.

Reporter	Title	Published	Views	Family All 11
circl	CVE-2025-34334	19 Nov 202517:30	–	circl
cnnvd	AudioCodes Fax Server 安全漏洞	19 Nov 202500:00	–	cnnvd
cvelist	CVE-2025-34334 AudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via TestFax.php & LPE	19 Nov 202516:23	–	cvelist
euvd	EUVD-2025-198195	19 Nov 202516:23	–	euvd
nvd	CVE-2025-34334	19 Nov 202517:15	–	nvd
osv	CVE-2025-34334	19 Nov 202517:15	–	osv
packetstorm	📄 AudioCodes Fax/IVR Appliance 2.6.23 File Upload / Code Execution / Privilege Escalation	20 Nov 202500:00	–	packetstorm
packetstormnews	AudioCodes Fax/IVR Appliance 2.6.23 Scanner	21 Nov 202500:00	–	packetstormnews
ptsecurity	PT-2025-47483	19 Nov 202500:00	–	ptsecurity
redhatcve	CVE-2025-34334	20 Nov 202521:36	–	redhatcve

NVD

Vulners

CNA

Node

audiocodes fax_serverRange≤2.6.23

audiocodes interactive_voice_responseRange≤2.6.23

[
  {
    "defaultStatus": "unknown",
    "product": "AudioCodes Fax/IVR Appliance",
    "vendor": "AudioCodes Limited",
    "versions": [
      {
        "lessThanOrEqual": "2.6.23",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
pierrekim	www.pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt
audiocodes	www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf
pierrekim	www.pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html
vulncheck	www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-authenticated-command-injection-via-testfax-and-lpe

Parameter	Position	Path	Description	CWE
name	upload data	AudioCodes_files/utils/IVR/diagram/ajaxScript.php	Post-authenticated command injection via unsanitized input in file_write path, enabling writing attacker-controlled web shells and executing commands as SYSTEM.	CWE-78
value	upload data	AudioCodes_files/utils/IVR/diagram/ajaxScript.php	Post-authenticated command injection via unsanitized input in file_write path, enabling writing attacker-controlled web shells and executing commands as SYSTEM.	CWE-78
fileToUpload	upload data	AudioCodes_files/ajaxBackupUploadFile.php	Pre-authentication file upload that can write arbitrary files to privileged directories, enabling further exploitation.	CWE-78
fileToUpload	upload data	AudioCodes_files/utils/IVR/diagram/ajaxPromptUploadFile.php	Pre-authenticated file upload vulnerability allowing arbitrary file uploads to critical directories.	CWE-78
baseDir	query param	AudioCodes_files/download.php	Pre-authenticated file read vulnerability exposing sensitive backups: potential data exposure.	CWE-78
f	query param	AudioCodes_files/download.php	Pre-authenticated file read vulnerability exposing sensitive backups: potential data exposure.	CWE-78
uploadedfile	upload data	F2MAdmin/F2E/AudioCodes_files/ActivateLicense.php	Post-authenticated file upload leading to command execution through unsanitized filename handling.	CWE-78
method	query param / path	/f2mw-service-api/?method=runBatch&fileName=tmp_1754486471_37.bat	Post-authenticated command injection via runBatch service executing crafted batch files with SYSTEM privileges.	CWE-78
fileName	query param / path	/f2mw-service-api/?method=runBatch&fileName=tmp_1754486471_37.bat	Post-authenticated command injection via runBatch service executing crafted batch files with SYSTEM privileges.	CWE-78

17 Jun 2026 09:13Current

7High risk

Vulners AI Score7

CVSS 3.18.8

CVSS 48.7

EPSS0.03188

SSVC

CWE-78