CVE-2025-34333

Name of the Vulnerable Software and Affected Versions AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23

Description The AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 are configured with overly permissive file system permissions for the web document root located at C:F2MAdminF2E. Authenticated local users have modify rights on this directory, while the web server process runs with SYSTEM privileges. This allows local users to create or alter server-side scripts within the webroot and then trigger them via HTTP requests, resulting in arbitrary code execution with SYSTEM privileges.

Recommendations Versions prior to 2.6.23 should be used.