CVE-2025-34329
Published: 19 November 2025
Description
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodes_files/ajaxBackupUploadFile.php in the F2MAdmin web interface. The script derives a backup folder path from application configuration, creates the directory if…
more
it does not exist, and then moves an uploaded file to that location using the attacker-controlled filename, without any authentication, authorization, or file-type validation. On default Windows deployments where the backup directory resolves to the system drive, a remote attacker can upload web server or interpreter configuration files that cause a log file or other server-controlled resource to be treated as executable code. This allows subsequent HTTP requests to trigger arbitrary command execution under the web server account, which runs as NT AUTHORITY\\SYSTEM.
Mitigating Controls (NIST 800-53 r5)AI
AC-3 enforces approved authorizations, directly mitigating the unauthenticated access to the backup upload endpoint that allows arbitrary file writes.
SI-10 requires validation of information inputs like uploaded files, addressing the lack of file-type and filename validation that enables dangerous file uploads leading to RCE.
SC-7 monitors and controls communications at boundaries, preventing remote unauthenticated exploitation by restricting access to the exposed F2MAdmin web interface.
Security SummaryAI
CVE-2025-34329 is an unauthenticated arbitrary file upload vulnerability (CWE-434: Unrestricted Upload of File with Dangerous Type) in AudioCodes Fax Server and Auto-Attendant IVR appliances, affecting versions up to and including 2.6.23. The issue exists in the F2MAdmin web interface, which exposes the endpoint AudioCodes_files/ajaxBackupUploadFile.php. This script derives a backup folder path from application configuration, creates the directory if needed, and moves an attacker-supplied file to that location using a fully attacker-controlled filename, with no authentication, authorization, or file-type validation. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A remote, unauthenticated attacker can exploit this endpoint to upload arbitrary files to the backup directory. On default Windows deployments, where the backup path resolves to the system drive, an attacker can upload web server or interpreter configuration files that coerce log files or other server-controlled resources to be interpreted as executable code. Follow-up HTTP requests to the affected appliance then trigger arbitrary command execution with the privileges of the web server account, which operates as NT AUTHORITY\SYSTEM.
Advisories published by Pierre Kim and Vulncheck provide technical details on the vulnerability, including proof-of-concept exploitation steps. AudioCodes has released a product notice announcing end-of-service for the Auto-Attendant IVR solution, with no patches referenced for the affected versions. Security practitioners should isolate exposed instances, restrict network access to the F2MAdmin interface, and consider migrating to supported products.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated arbitrary file upload in public-facing F2MAdmin web interface enables exploitation of public-facing application (T1190) and achieves RCE as NT AUTHORITY\SYSTEM, facilitating exploitation for privilege escalation (T1068).