Listen to this Post
The CVE-2025-34335 vulnerability exists within the license activation functionality of AudioCodes Fax Server and Auto-Attendant IVR appliances. The flaw is located in the `AudioCodes_files/ActivateLicense.php` script. When an authenticated user uploads a license file, the application processes the filename. It generates a base name for the file but uses the original upload’s extension portion directly, which is attacker-controlled. This user-supplied extension is then incorporated into a system command string without any validation or sanitization. The command constructs a path for the `fax_server_lic_cmdline.exe` executable. Due to missing input escaping and improper argument quotation, shell metacharacters can be injected via the filename extension. For example, an attacker could upload a file named license.lic;whoami. The semicolon and subsequent commands become part of the string passed to the `exec()` function. This causes the operating system shell to interpret the injected metacharacters as command separators. Consequently, arbitrary commands appended after the semicolon are executed. The process runs with the privileges of the web server, which in this context is NT AUTHORITY\SYSTEM. This provides complete compromise of the underlying Windows host. The vulnerability requires authentication to the license upload interface. Affected versions include all releases up to and including version 2.6.23. The core issue is the unsafe concatenation of user input into a shell command.
Platform: AudioCodes Fax Server
Version: Up to 2.6.23
Vulnerability: Authenticated Command Injection
Severity: Critical
date: 11/19/2025
Prediction: Patch TBA
What Undercode Say:
Analytics:
Example curl payload for command injection test curl -u "user:pass" -F "[email protected];\" http://target/audioCodes_files/ActivateLicense.php Checking for vulnerable endpoint grep -r "exec(" /var/www/html/ Simulating command concatenation echo "fax_server_lic_cmdline.exe license_$(date +%s).$ATTACKER_EXTENSION"
how Exploit:
An attacker authenticates to the web interface, navigates to the license upload feature, and uploads a file with a crafted name like exploit.lic;net user backdoor Passw0rd! /add. The injected command executes with SYSTEM privileges, allowing user creation, payload execution, or data exfiltration.
Protection from this CVE:
Apply vendor patch. Implement strict input validation on filenames. Use allow-lists for file extensions. Properly escape shell arguments. Minimize web application privileges. Segment network access to administrative interfaces.
Impact:
Full system compromise. Unauthorized privileged command execution. Complete loss of confidentiality, integrity, and availability. Potential for persistent backdoor installation and lateral movement within the network.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
