External risk intelligence

AudioCodes Fax Server and IVR Unauthenticated File Write Leading to Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-34328

The vulnerability exists in a web administration component of network appliances (Fax Server and IVR). Such appliances, particularly those handling voice and fax services, are frequently deployed at the network edge or as internet-facing gateways to facilitate remote communication, making their web management interfaces common targets for external network exposure.

Unrestricted File Upload

Audiocodes Fax Server

2.6.23 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in AudioCodes Fax Server and Auto-Attendant IVR appliances, affecting their web administration component. An unauthenticated remote attacker can exploit this to write arbitrary files to the product's web-accessible directory and subsequently execute them, potentially leading to system compromise. The main concern is confirming relevance and exposure of these appliances within your environment.

Web servers allow remote code execution.
Critical flaw impacts core communication appliances.
Confirm if these specific systems are in use.

Attack Path

How an attacker could exploit the issue

An attacker can reach a vulnerable web administration component on these appliances without any authentication. By sending a crafted request to a specific script, an attacker can write arbitrary files into the appliance's web-accessible directories. Once a malicious file is in place, the attacker can then trigger its execution, leading to the execution of arbitrary code on the appliance with high privileges.

Unauthenticated network access required.
Writing and executing arbitrary files.
High-privilege code execution risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability affects AudioCodes Fax Server and Auto-Attendant IVR appliances. An unauthenticated attacker could write arbitrary files to the web-accessible directory structure, potentially leading to the execution of malicious scripts.

System files and web-accessible content at risk.
Attacker writes arbitrary files via web interface.
Arbitrary code execution may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

Infrastructure and Security teams are likely responsible for addressing this vulnerability in AudioCodes Fax Server and Auto-Attendant IVR appliances. The first step is to identify all instances of the affected technology, determine their business criticality and external reachability, and then locate the accountable system owner to plan remediation based on risk.

Infrastructure or Security teams own resolution.
Verify external reachability and business impact.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What are AudioCodes Fax Server and IVR appliances?

These are specialized network appliances used to manage voice communications, automated attendant services, and fax processing. They often function as gateways or controllers within telecommunications infrastructure, utilizing a web-based administration tool, F2MAdmin, to handle device configuration and script management tasks.

What is the vulnerability in CVE-2025-34328?

This vulnerability is an Unrestricted Upload of File with Dangerous Type, classified as CWE-434. It means the system's administrative script-management feature lacks authentication checks, allowing remote users to upload and save arbitrary files directly into the web server's directory, which can subsequently be triggered to run malicious code.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a crafted request to a specific, unprotected endpoint used for script management. No authentication is required to access this path. Note that the vulnerability relates to the file-writing capability of the web interface; it is not triggered by normal voice or fax traffic processing, but rather through unauthorized interaction with the management component.

Is my device vulnerable if it is not internet-facing?

Halo Surface Signal notes that these appliances are often deployed as internet-facing gateways, significantly increasing risk. While internal devices are less accessible to external attackers, they remain potentially vulnerable to any actor with network access to the management interface. You should prioritize assets that have the administrative web console exposed to wider network segments.

What steps should I take if I use these appliances?

First, conduct an inventory to identify all instances of affected AudioCodes hardware running version 2.6.23 or earlier. Once identified, assess whether the web management interface is reachable from untrusted networks. Engage the system owners to evaluate the current risk and coordinate a secure configuration or remediation strategy based on your organization's internal standards.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.