CVE-2025-34329: Audiocodes Fax Server

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodes_files/ajaxBackupUploadFile.php in the F2MAdmin web interface. The script derives a backup folder path from application configuration, creates the directory if it does not exist, and then moves an uploaded file to that location using the attacker-controlled filename, without any authentication, authorization, or file-type validation. On default Windows deployments where the backup directory resolves to the system drive, a remote attacker can upload web server or interpreter configuration files that cause a log file or other server-controlled resource to be treated as executable code. This allows subsequent HTTP requests to trigger arbitrary command execution under the web server account, which runs as NT AUTHORITY\\SYSTEM.

Affected products

• Audiocodes Fax Server: up to and including 2.6.23
• Audiocodes Interactive Voice Response: up to and including 2.6.23

Published 2025-11-19. Last modified 2026-06-17.