CVE-2025-34328

AudioCodes Fax Server and Auto-Attendant IVR appliances (≤ 2.6.23) expose an unauthenticated script-management endpoint in the web administration component (F2MAdmin) at AudioCodes_files/utils/IVR/diagram/ajaxScript.php. The saveScript action writes attacker-supplied data directly to a server-sid...

CVE-2025-34329

CVE-2025-34329 affects AudioCodes Fax Server and Auto-Attendant IVR appliances ≤2.6.23. An unauthenticated backup upload endpoint at AudioCodes_files/ajaxBackupUploadFile.php in the F2MAdmin web interface allows uploading a file to a configured backup path, with no authentication, authorization, ...

CVE-2025-34334

AudioCodes Fax Server and Auto-Attendant IVR appliances up to version 2.6.23 are vulnerable to authenticated command injection in the fax test feature (TestFax.php). An attacker with access to the fax test interface can craft parameters that are incorporated into the faxsender command line, which...

CVE-2025-34330

The CVE-2025-34330 entry affects AudioCodes Fax Server and Auto-Attendant IVR appliances up to version 2.6.23. A web admin component (F2MAdmin) exposes an unauthenticated endpoint at AudioCodes_files/utils/IVR/diagram/ajaxPromptUploadFile.php that accepts uploaded files and writes them into C:\F2...

CVE-2025-34331

CVE-2025-34331 affects AudioCodes Fax Server and Auto-Attendant IVR appliances up to version 2.6.23. The issue is an unauthenticated file read via the download.php endpoint, which lacks access control and lets remote, unauthenticated users request files based on attacker-supplied path/filename. T...

CVE-2025-34335

AudioCodes Fax Server and Auto-Attendant IVR appliances up to version 2.6.23 are affected by an authenticated command injection in the license activation workflow (ActivateLicense.php). An authenticated user uploading a license file can craft the file name’s extension to inject shell metacharacte...

CVE-2025-34332

CVE-2025-34332 affects AudioCodes Fax Server and Auto-Attendant IVR appliances up to version 2.6.23. A web administration component runs Windows service actions via helper batch scripts in C:\F2MAdmin\F2E\AudioCodes_files\utils\Services. When service actions are requested through ajaxPost.php, PH...

CVE-2025-34333

CVE-2025-34333 affects AudioCodes Fax Server and Auto-Attendant IVR appliances