AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 configure the web document root at C:\\F2MAdmin\\F2E with overly permissive file system permissions. Authenticated local users have modify rights on this directory, while the associated web server process runs as NT AUTHORITY\\SYSTEM. As a result, any local user can create or alter server-side scripts within the webroot and then trigger them via HTTP requests, causing arbitrary code to execute with SYSTEM privileges.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 8.5 · audiocodesNVD modified 2026-10-18 20:10
Affected (CPE criteria) 2
cpe:2.3:a:audiocodes:fax_server:*:*:*:*:*:*:*:*cpe:2.3:a:audiocodes:interactive_voice_response:*:*:*:*:*:*:*:*
References 4
- https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt Exploit, Third Party Advisory
- https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html Exploit, Third Party Advisory
- https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf Product
- https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-world-writable-webroot-lpe Third Party Advisory