Key Vulnerability Information Severity High Date November 19, 2025 Affected Product AudioCodes Fax/IVR Appliance <= 2.6.23 Vulnerability CVE-2025-34332 CWE-276 Incorrect Default Permissions CVSS V4 Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N References AudioCodes EoS/EoL Product Notice Researcher Blog Researcher Advisory Credit Pierre Barre Description AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component that controls back-end Windows services using helper batch scripts located under . When certain service actions are requested through , these scripts are invoked by PHP using system() under the account. The batch files in this directory are writable by any authenticated local user due to overly permissive ACLs, allowing them to replace script contents with arbitrary commands. On the next service start/stop operation, the modified script is executed as SYSTEM, enabling elevation of local privileges.