CVE-2025-34333
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-19

Last updated on: 2025-12-11

Assigner: VulnCheck

Description
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 configure the web document root at C:\\F2MAdmin\\F2E with overly permissive file system permissions. Authenticated local users have modify rights on this directory, while the associated web server process runs as NT AUTHORITY\\SYSTEM. As a result, any local user can create or alter server-side scripts within the webroot and then trigger them via HTTP requests, causing arbitrary code to execute with SYSTEM privileges.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-19
Last Modified
2025-12-11
Generated
2026-06-16
AI Q&A
2025-11-19
EPSS Evaluated
2026-06-14
NVD
CVE-2025-34333
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
audiocodes fax_server to 2.6.23 (inc)
audiocodes interactive_voice_response to 2.6.23 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-276 During installation, installed file permissions are set to allow anyone to modify those files.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in AudioCodes Fax Server and Auto-Attendant IVR appliances up to version 2.6.23, where the web document root directory is configured with overly permissive file system permissions. Authenticated local users have modify rights on this directory, while the web server process runs with SYSTEM privileges. This allows any local user to create or modify server-side scripts in the webroot and execute them via HTTP requests, resulting in arbitrary code execution with SYSTEM-level privileges.

Impact Analysis

The vulnerability can allow an authenticated local user to execute arbitrary code with SYSTEM privileges on the affected device. This can lead to full control over the system, potentially allowing the attacker to manipulate data, disrupt services, or further compromise the network.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-34333. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart