High · published November 19, 2025
⚡ Any local user can modify server-side scripts and run them with SYSTEM privileges! This is a huge risk, especially when the server trusts its own users way too much. 🔥 Think of it like allowing guests in a hotel to carry around the master keys to every room. They can easily waltz in and change the decor or take whatever they please without anyone batting an eye! An attacker could exploit this vulnerability to run arbitrary code at the highest level, gaining complete control over the system. This could lead to unauthorized data access, system manipulation, or even full system compromise, putting sensitive information at risk and disrupting critical services.
Think of it like allowing guests in a hotel to carry around the master keys to every room. They can easily waltz in and change the decor or take whatever they please without anyone batting an eye! This vulnerability arises from overly permissive file system permissions on the web document root for AudioCodes Fax Server and Auto-Attendant IVR appliances. Local authenticated users can create or alter server-side scripts, which can be executed by the web server running as NT AUTHORITY\SYSTEM.
An attacker could exploit this vulnerability to run arbitrary code at the highest level, gaining complete control over the system. This could lead to unauthorized data access, system manipulation, or even full system compromise, putting sensitive information at risk and disrupting critical services. To mitigate this risk, immediately review and restrict file system permissions on the C:\F2MAdmin\F2E directory. Ensure that local users only have the permissions necessary for their role and consider upgrading to a patched version of the software, if available. You've got this! Follow these steps to tighten security and keep your systems safe. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| audiocodes/fax_server | ≤ 2.6.23 | — |
| audiocodes/interactive_voice_response | ≤ 2.6.23 | — |