Listen to this Post
The CVE-2025-34333 vulnerability exists in AudioCodes Fax Server and Auto-Attendant IVR appliances. Affected versions include all releases up to and including version 2.6.23. The core misconfiguration is in the web document root path. This path is set to C:\F2MAdmin\F2E on the Windows filesystem. The file system permissions for this directory are configured incorrectly. They are set to be overly permissive for authenticated users. Any user with a local authenticated account has modify rights. This means they can create new files within this directory. They can also alter existing files that are already present. Concurrently, the web server process that uses this directory runs with high privileges. It executes under the NT AUTHORITY\SYSTEM account. This is the highest privilege level on a Windows operating system. Therefore, a local user can place a server-side script file in the webroot. Scripts like ASP, ASPX, or CGI files can be used for this purpose. The user can then trigger the execution of this script. This is done by making a standard HTTP request to the server. The web server will receive and process this request. It will execute the user-uploaded script file in the context of the web server process. Since the process runs as SYSTEM, the script runs with SYSTEM privileges. This leads to full arbitrary code execution and complete system compromise. The vulnerability effectively allows local privilege escalation to SYSTEM level.
Platform: AudioCodes Fax Server
Version: <= 2.6.23
Vulnerability: Arbitrary Code Execution
Severity: Critical
date: 11/19/2025
Prediction: Patch TBA
What Undercode Say:
Analytics
Showing bash commands and codes related to the blog
Check directory permissions (from a Windows bash-like shell such as Git Bash)
icacls “C:\F2MAdmin\F2E”
List contents of the webroot directory
ls -la “/mnt/c/F2MAdmin/F2E/”
Example HTTP request to trigger a hypothetical script
curl -X GET http://
how Exploit:
Authenticated local user creates a malicious script file in C:\F2MAdmin\F2E. User accesses the script via web browser or HTTP tool to execute code as SYSTEM.
Protection from this CVE
Restrict directory permissions; apply vendor patch; use least privilege accounts.
Impact:
SYSTEM privilege escalation; full host compromise; data theft; backdoor installation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
