CVE-2025-34333

Katalog CVE

CVSS 7.8 · High EPSS 0,20%

Kerentanan Incorrect Default Permissions pada audiocodes fax server, audiocodes interactive voice response. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 configure the web document root at C:\\F2MAdmin\\F2E with overly permissive file system permissions. Authenticated local users have modify rights on this directory, while the associated web server process runs as NT AUTHORITY\\SYSTEM. As a result, any local user can create or alter server-side scripts within the webroot and then trigger them via HTTP requests, causing arbitrary code to execute with SYSTEM privileges.

Rincian

Terbit di NVD

19 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-276: Incorrect Default Permissions

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt exploit · advisory pihak ketiga
• https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html exploit · advisory pihak ketiga
• https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-world-writable-webroot-lpe advisory pihak ketiga
• https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr... product