AudioCodes Fax/IVR Appliance <= 2.6.23 World-Writable Webroot LPE

Advisories

severity: high
date: November 19, 2025
Affecting: Fax/IVR Appliance <= 2.6.23
This product was declared "End-of-Service" on 2024-12-31
CVE: CVE-2025-34333
CWE: CWE-276 Incorrect Default Permissions
CVSS: 8.5
CVSS V4 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: AudioCodes EoS/EoL Product Notice
Researcher Blog
Researcher Advisory
Credit: Pierre Barre
Description: AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 configure the web document root at C:\\F2MAdmin\\F2E with overly permissive file system permissions. Authenticated local users have modify rights on this directory, while the associated web server process runs as NT AUTHORITY\\SYSTEM. As a result, any local user can create or alter server-side scripts within the webroot and then trigger them via HTTP requests, causing arbitrary code to execute with SYSTEM privileges.