CVE-2025-34333: Audiocodes Fax Server

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 configure the web document root at C:\\F2MAdmin\\F2E with overly permissive file system permissions. Authenticated local users have modify rights on this directory, while the associated web server process runs as NT AUTHORITY\\SYSTEM. As a result, any local user can create or alter server-side scripts within the webroot and then trigger them via HTTP requests, causing arbitrary code to execute with SYSTEM privileges.

Affected products

• Audiocodes Fax Server: up to and including 2.6.23
• Audiocodes Interactive Voice Response: up to and including 2.6.23

Published 2025-11-19. Last modified 2026-06-17.