PT-2025-47481 · Microsoft+1 · Windows+2

Pierre Barre · Published 2025-11-19 · Updated 2025-12-11 · CVE-2025-34332

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23

Description The web administration component of the software controls Windows services using batch scripts located under C:F2MAdminF2EAudioCodes filesutilsServices. These scripts are invoked by PHP using the system() function under the NT AUTHORITYSYSTEM account when certain service actions are requested through the ajaxPost.php endpoint. Overly permissive Access Control Lists (ACLs) allow any authenticated local user to modify the contents of these scripts. By replacing script contents with arbitrary commands, an attacker can achieve local privilege escalation when the modified script is executed as SYSTEM during service start or stop operations.

Recommendations Versions prior to 2.6.23 should be used.

Exploit

Fix

LPE

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-34332

Affected Products

Audiocodes Fax Server

Auto-Attendant Ivr

Windows

References · 9

• 🔥 https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt · Exploit
• 🔥 https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html · Exploit
• https://osv.dev/vulnerability/CVE-2025-34332 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34332 · Security Note
• https://vulncheck.com/advisories/audiocodes-fax-ivr-appliance-insecure-service-control-scripts-lpe · Note
• https://audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf · Patch, Vendor Advisory
• https://t.me/CVEtracker/37742 · Telegram Post
• https://t.me/cveNotify/145507 · Telegram Post
• https://twitter.com/CVEnew/status/1991187283643650108 · Twitter Post