CVE-2025-34334: AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 are vulnerable to an…
CVE-2025-34334 · Severity: high · CVSS 8.8 · Published 2025-11-19
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 are vulnerable to an authenticated command injection in the fax test functionality implemented by AudioCodes_files/TestFax.php. When a fax "send" test is requested, the application builds a faxsender command line using attacker-supplied parameters and passes it to GlobalUtils::RunBatchFile without proper validation or shell-argument sanitization. The resulting batch file is written into a temporary run directory and then executed via a backend service that runs as NT AUTHORITY\\SYSTEM. An authenticated attacker with access to the fax test interface can craft parameter values that inject additional shell commands into the generated batch file, leading to arbitrary command execution with SYSTEM privileges. In addition, because the generated batch files reside in a location with overly permissive file system permissions, a local low-privilege user on the server can modify pending batch files to achieve the same elevation.
No. Junglewise Threat Intelligence has no report of CVE-2025-34334 being exploited in the wild.
How severe is CVE-2025-34334?
High severity, with a CVSS score of 8.8, published 19 November 2025.
Which products and versions are affected?
Audiocodes Fax Server, Audiocodes Interactive Voice Response. The advisory does not name versions.
Is there a fix for CVE-2025-34334?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2025-34334?
Check whether you run Audiocodes Fax Server or Audiocodes Interactive Voice Response. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.