CVE-2025-34328

Description

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an unauthenticated script-management endpoint at AudioCodes_files/utils/IVR/diagram/ajaxScript.php. The saveScript action writes attacker-supplied data directly to a server-side file path under the privileges of the web service account, which runs as NT AUTHORITY\\SYSTEM on Windows deployments. A remote, unauthenticated attacker can write arbitrary files into the product’s web-accessible directory structure and subsequently execute them.

Weakness classification

• disclosure@vulncheck.com: CWE-434

Primary references

• disclosure@vulncheck.com — Exploit, Third Party Advisory
• disclosure@vulncheck.com — Exploit, Third Party Advisory
• disclosure@vulncheck.com — Product
• disclosure@vulncheck.com — Third Party Advisory