High · published November 19, 2025
⚡ Overly permissive file permissions let any local user upgrade themselves to SYSTEM - that's a security nightmare waiting to happen! 🔥 Think of it as a mischievous employee who gains access to the company vault because nobody locked the door properly. They can change the combination and access all the secrets whenever they want! An attacker could take control of the system, running any commands they choose under the powerful SYSTEM account. This means they could manipulate critical services, access sensitive data, or even cause catastrophic damage by shutting things down at will. Absolutely devastating!
Think of it as a mischievous employee who gains access to the company vault because nobody locked the door properly. They can change the combination and access all the secrets whenever they want! This vulnerability allows local authenticated users to modify batch scripts used by the web administration component of AudioCodes Fax Server and Auto-Attendant IVR appliances. When these scripts are executed, they run with SYSTEM privileges, enabling privilege escalation for the attacker.
An attacker could take control of the system, running any commands they choose under the powerful SYSTEM account. This means they could manipulate critical services, access sensitive data, or even cause catastrophic damage by shutting things down at will. Absolutely devastating! Immediately patch to version 2.6.24 or later to close this vulnerability. Review and tighten the ACLs on the mentioned batch scripts to prevent unauthorized modifications. Regularly audit user permissions to ensure only the right people have access! You've got this! Follow these steps, and you’ll have your system secured in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| audiocodes/fax_server | ≤ 2.6.23 | — |
| audiocodes/interactive_voice_response | ≤ 2.6.23 | — |