Listen to this Post
How the Mentioned CVE Works
The vulnerability is an authenticated command injection in the fax test functionality of AudioCodes appliances. The process begins when an authenticated user submits a fax “send” test request via the `AudioCodes_files/TestFax.php` script. The application builds a command line for the `faxsender` utility using parameters supplied by the user. These attacker-controlled parameters are passed to a function called `GlobalUtils::RunBatchFile` without proper validation or shell-argument sanitization. The function writes the constructed command line into a temporary batch file within a run directory. This batch file is then executed by a backend Windows service that operates with `NT AUTHORITY\SYSTEM` privileges. An attacker can craft parameter values containing shell metacharacters (like `&` or |) to break out of the intended command and inject arbitrary operating system commands. Furthermore, the temporary run directory has overly permissive file system permissions. This allows a local low-privilege user on the server to find pending batch files, modify their contents, and achieve the same SYSTEM-level command execution without needing web authentication.
DailyCVE Form
Platform: AudioCodes Fax/IVR Appliance
Version: <= 2.6.23
Vulnerability: Authenticated Command Injection
Severity: High
Date: 2025-11-19
Prediction: Patch unlikely (EOS)
What Undercode Say:
Bash Commands and Codes: No specific bash commands for CVE-2025-34334 were provided in the available data. However, related vulnerabilities in the same product family involve curl commands for file upload and code execution. For example, a proof-of-concept for a pre-authenticated RCE used: curl -kv "http://[bash]/AudioCodes_files/utils/IVR/diagram/ajaxScript.php?action=saveScript" -d "name=../../webshell.php&value=<?php system($_GET['c']);?>".
How Exploit:
Remote Attack Vector: An attacker with authenticated access to the web administration interface can navigate to the fax test functionality. They supply maliciously crafted parameters (e.g., phone number, filename) that inject commands into the resulting batch file, leading to execution with SYSTEM privileges.
Local Attack Vector: A user with local shell access and low privileges can locate the temporary batch files in the insecure run directory. They can then overwrite the command in a pending batch file with their own malicious commands, which will be executed by the SYSTEM service.
Protection from this CVE
Official Patch: The product was declared End-of-Service (EOS) on December 31, 2024, making an official patch unlikely.
Primary Mitigation: Immediately isolate the appliance from networks, especially the internet. Do not expose its web interface.
System Hardening: Apply the principle of least privilege to file and directory permissions. Remove or restrict access to vulnerable web pages like TestFax.php.
Compensating Controls: Implement strict network segmentation and monitor for anomalous process execution originating from the appliance.
Impact:
Full System Compromise: Successful exploitation grants an attacker complete control over the Windows server with the highest `NT AUTHORITY\SYSTEM` privileges.
Lateral Movement: A compromised fax server can be used as a foothold to move laterally within telecom and IT infrastructures.
Multiple Vulnerabilities: This CVE is one of several critical vulnerabilities (including pre-authenticated RCE flaws) found in the same appliance, compounding the overall risk.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
