External risk intelligence

AudioCodes Fax and IVR Appliances Command Execution via Unauthenticated Backup Upload.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-34329

The vulnerability exists in an appliance interface designed to handle administrative tasks such as backup uploads. Because these are appliance-based solutions (Fax Server and IVR) that manage external communications, their web interfaces are frequently deployed at the network edge or in accessible internal network segments. The unauthenticated nature of this specific endpoint makes it a direct, pre-auth internet-facing target.

Unrestricted File Upload

Audiocodes Fax Server

2.6.23 and earlier

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in AudioCodes Fax Server and Auto-Attendant IVR appliances could allow an unauthenticated remote attacker to execute arbitrary commands on affected systems. This is due to an insecure backup upload feature that does not validate file types or authenticate users, potentially enabling the upload of malicious configuration files that could lead to system compromise.

Unauthenticated file upload allows code execution.
Critical risk to appliance integrity and operations.
Confirm relevance and assess exposure to appliances.

Attack Path

How an attacker could exploit the issue

An attacker can leverage an unauthenticated backup upload feature to execute arbitrary code on the server. This is possible by uploading a specially crafted configuration file that the server then misinterprets as executable code, leading to command execution with high privileges.

No authentication required.
Upload malicious configuration file.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

On AudioCodes Fax Server and Auto-Attendant IVR appliances, an unauthenticated backup upload vulnerability could allow a remote attacker to execute arbitrary commands. This is possible when the backup directory is configured to reside on the system drive in Windows deployments, enabling the upload of malicious configuration files that are then treated as executable code by the web server.

Server configuration files.
Uploading malicious files to specific paths.
Arbitrary command execution as SYSTEM.

Operational Fix

Recommended remediation, mitigation, and detection steps

The AudioCodes Fax Server and IVR appliances are likely managed by infrastructure or platform teams responsible for maintaining these dedicated communication appliances, with potential oversight from network and security teams due to their external-facing nature. The first practical step is to locate all deployed instances, determine their exposure and criticality, identify the accountable owner, and then develop a remediation plan based on these findings.

Infrastructure and platform teams own remediation.
Verify appliance exposure and business criticality.
Coordinate vendor patching and plan deployment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the AudioCodes Fax Server and IVR appliance?

These are dedicated communication devices used by organizations to manage automated telephony, faxing, and auto-attendant services. They function as centralized hardware appliances that handle voice and data traffic, often serving as critical infrastructure for internal and external enterprise communications.

How does this vulnerability allow for arbitrary command execution?

This flaw belongs to the Unrestricted Upload of File with Dangerous Type class (CWE-434). Because the administrative interface fails to authenticate users or check file types, an attacker can upload configuration files directly to the server. On Windows-based systems, these files can trick the web server into running them as code, granting the attacker system-level execution rights.

What triggers the vulnerability in the backup upload endpoint?

The vulnerability is triggered by sending an HTTP request to the specific file upload endpoint without needing a login. Crucially, the flaw is not triggered if the system is configured to store backup files in a non-executable location, but it remains a risk whenever the backup directory resolves to the system drive.

Is my appliance at risk based on Halo Surface Signal?

Halo Surface Signal indicates that these appliances are frequently deployed at the network edge or in reachable internal segments because they manage external communications. Since this endpoint is unauthenticated, any instance reachable over a network is considered a direct, high-priority target for unauthorized access.

How should I respond if I am running these AudioCodes devices?

Begin by auditing your infrastructure to create a complete inventory of all deployed Fax Server and IVR units. Once located, verify their network accessibility to determine the immediate risk level. Finally, engage your infrastructure and security teams to prioritize these appliances for vendor-supplied updates or necessary configuration changes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.