Unauthenticated File Upload Vulnerability in AudioCodes Fax Server and Auto-Attendant IVR Appliances
CVE-2025-34328

9.3CRITICAL

Key Information:

Vendor: Audiocodes Limited
Status: Audiocodes Fax/ivr Appliance
Vendor: CVE Published:; 19 November 2025

🔔 Create Audiocodes Limited Vulnerability Alert

Badges

👾 Exploit Exists

What is CVE-2025-34328?

The AudioCodes Fax Server and Auto-Attendant IVR appliances possess a critical vulnerability due to an insecure web administration component (F2MAdmin). This flaw enables remote, unauthenticated attackers to exploit a script-management endpoint, allowing them to write arbitrary files to the server's file structure. The saveScript action directly accepts attacker-supplied data and saves it under the privileges of the web service account, which operates with elevated rights on Windows systems. Consequently, attackers can not only inject files but also execute them, potentially leading to severe security breaches.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch