CVE-2025-34332
📋 TL;DR
This vulnerability allows any authenticated local user on AudioCodes Fax Server and Auto-Attendant IVR appliances to escalate privileges to SYSTEM by replacing writable batch scripts. The scripts are executed with SYSTEM privileges when service operations are performed through the web administration interface. Affected systems are all versions up to and including 2.6.23.
💻 Affected Systems
- AudioCodes Fax Server
- AudioCodes Auto-Attendant IVR appliances
📦 What is this software?
Fax Server by Audiocodes
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise where an authenticated attacker gains SYSTEM privileges, enabling complete control over the Windows system, installation of malware, credential theft, and persistence.
Likely Case
Local privilege escalation by authenticated users (including low-privileged accounts) to gain SYSTEM-level access for lateral movement or data exfiltration.
If Mitigated
Limited impact if proper access controls restrict local user accounts and network segmentation isolates vulnerable systems.
🎯 Exploit Status
Exploitation requires local authentication but is straightforward: replace batch file contents and trigger service operations. Public details are available in referenced advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf
Restart Required: No
Instructions:
No official patch is available. The vendor has announced end-of-service for affected products. Consider workarounds or migration to supported solutions.
🔧 Temporary Workarounds
Restrict ACLs on batch scripts
windowsModify file permissions to remove write access for non-administrative users on the vulnerable batch scripts.
icacls "C:\F2MAdmin\F2E\AudioCodes_files\utils\Services\*.bat" /deny "Users":(W)
Disable web administration interface
windowsIf not required, disable the web administration component to prevent access to ajaxPost.php.
Stop and disable the web service (e.g., IIS or Apache) hosting the administration interface.
🧯 If You Can't Patch
- Isolate affected systems on network segments with strict access controls to limit exposure to authenticated users.
- Implement least privilege for local user accounts and monitor for suspicious file modifications in the vulnerable directory.
🔍 How to Verify
Check if Vulnerable:
Check if files in C:\F2MAdmin\F2E\AudioCodes_files\utils\Services\ are writable by non-administrative users using: icacls "C:\F2MAdmin\F2E\AudioCodes_files\utils\Services\*.bat"Check Version:
Check the appliance version via web interface or configuration files; version should be 2.6.23 or earlier.Verify Fix Applied:
Verify that non-administrative users cannot write to batch scripts in the Services directory after applying ACL restrictions.📡 Detection & Monitoring
Log Indicators:
- Unusual file modifications in C:\F2MAdmin\F2E\AudioCodes_files\utils\Services\
- Process execution of batch scripts from the Services directory by SYSTEM account
- Web logs showing requests to ajaxPost.php with service control parameters
Network Indicators:
- HTTP requests to the administration interface from unexpected internal IPs
SIEM Query:
EventID=4688 AND (CommandLine LIKE '%C:\F2MAdmin\F2E\AudioCodes_files\utils\Services%' OR NewProcessName LIKE '%.bat') AND SubjectUserName='SYSTEM'🔗 References
- https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt
- https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html
- https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf
- https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-insecure-service-control-scripts-lpe
