CVE-2025-34330

MediumCVSS 5.3

Published: 19/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

39th percentile - higher than 39% of all known CVEs

Summary

AudioCodes Fax Server and Auto-Attendant IVR appliances up to version 2.6.23 expose an unauthenticated file upload endpoint (ajaxPromptUploadFile.php) in the F2MAdmin web component. A remote attacker can upload or overwrite files in C:\F2MAdmin\tmp without authentication or file-type validation.

Risk Assessment

Attackers could tamper with IVR audio content or stage files for further attacks, potentially causing fraud or service disruption. The vulnerability is easily exploitable remotely without login.

Recommendation

Update the software to a patched version or restrict access to the ajaxPromptUploadFile.php endpoint. Verify the integrity of files in the tmp directory and monitor for unauthorized uploads.

Other vulnerabilities in AudioCodes Fax Server and Auto-Attendant IVR

CVE-2025-34335High
AudioCodes Fax Server and Auto-Attendant IVR appliances up to and including 2.6.23 expose an authenticated command injection in the license activation workflow handled by AudioCodes_files/ActivateLicense.php. The extension of the uploaded license filename is incorporated into a command line without validation, allowing an authenticated user to execute arbitrary commands as NT AUTHORITY\SYSTEM.

Original NVD description (English source)

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an unauthenticated prompt upload endpoint at AudioCodes_files/utils/IVR/diagram/ajaxPromptUploadFile.php. The script accepts an uploaded file and writes it into the C:\\F2MAdmin\\tmp directory using a filename derived from application constants, without any authentication, authorization, or file-type validation. A remote, unauthenticated attacker can upload or overwrite prompt- or music-on-hold–related files in this directory, potentially leading to tampering with IVR audio content or preparing files for use in further attacks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS