Listen to this Post
The vulnerability exists in the web administration component of AudioCodes Fax Server and Auto-Attendant IVR appliances. When an administrator performs service actions (like start or stop) through the `ajaxPost.php` interface, the PHP code uses the `system()` function to execute corresponding helper batch scripts (.bat files) located in C:\F2MAdmin\F2E\AudioCodes_files\utils\Services. These batch scripts are executed under the high-privilege `NT AUTHORITY\SYSTEM` account. The critical security flaw is that the Access Control Lists (ACLs) on this specific directory and its batch files are overly permissive, allowing any authenticated user on the Windows system (not just administrators) to modify or overwrite these scripts. A local attacker with standard user credentials can therefore replace the contents of a legitimate batch file with arbitrary commands. The next time an administrator uses the web interface to control the associated service, the malicious batch file is invoked by `ajaxPost.php` via system(), resulting in the attacker’s commands being executed with SYSTEM privileges, leading to a complete local privilege escalation.
Platform: AudioCodes Fax Server & IVR
Version: Up to and including 2.6.23
Vulnerability: Local Privilege Escalation
Severity: Critical
date: 2025-11-19
Prediction: 2025-12-25
What Undercode Say:
Check permissions on the vulnerable directory icacls "C:\F2MAdmin\F2E\AudioCodes_files\utils\Services" Example: Create a malicious batch file to add a user to administrators echo net localgroup administrators hacker /add > C:\Temp\evil.bat Copy the malicious batch file to overwrite a legitimate service script (requires authenticated user access) copy /Y C:\Temp\evil.bat "C:\F2MAdmin\F2E\AudioCodes_files\utils\Services\StopService.bat"
// Simplified excerpt illustrating the vulnerable PHP call in ajaxPost.php
$serviceAction = $_POST['action']; // e.g., 'start' or 'stop'
$scriptPath = "C:\F2MAdmin\F2E\AudioCodes_files\utils\Services\{$serviceAction}Service.bat";
system($scriptPath); // Executes batch file with SYSTEM privileges
How Exploit:
- Gain access as an authenticated local user on the Windows host running the AudioCodes software.
- Navigate to or write to the `C:\F2MAdmin\F2E\AudioCodes_files\utils\Services\` directory.
- Identify a target batch file (e.g.,
StopF2MService.bat) and overwrite its contents with malicious commands. - Wait for or trigger a service management action through the administrative web interface (
ajaxPost.php), causing the malicious script to run as SYSTEM.
Protection from this CVE:
Apply the vendor patch immediately when released.
Manually restrict NTFS permissions on the `…\utils\Services\` directory to allow write access only to necessary service accounts and administrators.
Implement host-based intrusion detection to monitor for unauthorized changes to batch files in sensitive paths.
Impact:
Complete compromise of the underlying Windows system, enabling an attacker to establish persistence, disable security controls, steal credentials, and potentially move laterally to domain assets.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
