CVE-2025-34335
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-19

Last updated on: 2025-12-11

Assigner: VulnCheck

Description
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an authenticated command injection vulnerability in the license activation workflow handled by AudioCodes_files/ActivateLicense.php. When a license file is uploaded, the application derives a new filename by combining a generated base name with the attacker-controlled extension portion of the original upload name, then constructs a command line for fax_server_lic_cmdline.exe that includes this path. The extension value is incorporated into the command string without input validation, escaping, or proper argument quotation before being passed to exec(). An authenticated user with access to the license upload interface can supply a specially crafted filename whose extension injects additional shell metacharacters, causing arbitrary commands to be executed as NT AUTHORITY\\SYSTEM.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-19
Last Modified
2025-12-11
Generated
2026-05-07
AI Q&A
2025-11-19
EPSS Evaluated
2026-05-05
NVD
CVE-2025-34335
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
audiocodes fax_server to 2.6.23 (inc)
audiocodes interactive_voice_response to 2.6.23 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in AudioCodes Fax Server and Auto-Attendant IVR appliances up to version 2.6.23. It is an authenticated command injection flaw in the license activation process. When a license file is uploaded, the system constructs a command line using the uploaded file's extension without proper validation or escaping. An authenticated user can craft a filename with a malicious extension that injects shell commands, which are then executed with NT AUTHORITY\SYSTEM privileges, allowing arbitrary command execution on the system.


How can this vulnerability impact me? :

This vulnerability can allow an authenticated attacker to execute arbitrary commands on the affected system with the highest system privileges (NT AUTHORITY\SYSTEM). This can lead to full system compromise, unauthorized access to sensitive data, disruption of services, installation of malware, or further attacks within the network.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart