CVE-2025-34328 is a critical unauthenticated file upload flaw (CVSS 9.8) in the AudioCodes Fax Server and Auto-Attendant IVR web administration page. Versions up to and including 2.6.23 are affected. The product is end of service and no fixed version is confirmed, so remove it from untrusted networks and plan a replacement.
What's affected
The record says AudioCodes Fax Server and Auto-Attendant IVR appliances up to and including version 2.6.23 are affected. The affected component is the F2MAdmin web interface, which exposes a script management endpoint without authentication.
The VulnCheck advisory states that the product was declared End-of-Service on 31 December 2024, and the record links an AudioCodes end of service notice. I could not confirm any fixed version, and with the product retired a patch is unlikely. Check the AudioCodes notice and your support contact for any guidance.
On Windows deployments the web service account runs as NT AUTHORITY SYSTEM, so a successful attack would run with the highest local privileges.
How to check if you're exposed
Check whether you run this product at all. Look for AudioCodes Fax Server or Auto-Attendant IVR in your server inventory, software list and any telephony closet you forgot about. The version is shown in the product's admin interface.
If you have it, find out who can reach its web administration port. From a machine on a different network segment, test whether the admin page loads. If it does, the exposure is wide. The affected endpoint requires no login, so network reachability is the only barrier.
Review the web directory of the host for files you did not create. The record says an attacker can write files into the product's web accessible directory, so unexpected files there are worth investigating. Your incident response team should handle anything suspicious.
What to do now
- Remove the web administration interface from every network that is not a locked down management segment. Do not expose it to the internet under any circumstances.
- Put a firewall or reverse proxy rule in front of it that allows only named administrator addresses.
- Inspect the web directory and the host for unexpected files, and review recent logins and process starts.
- Plan to retire the product. It is end of service, so future flaws are unlikely to be fixed, and this CVE is one of several the researcher published for it.
- Contact AudioCodes or your reseller for any official mitigation or migration path.
Why it matters
The class is CWE-434 (Unrestricted Upload of File with Dangerous Type). A script management action writes data supplied by the caller straight to a file path on the server, with no login and no check on what is written. Because the destination is inside a directory the web server serves, a written file can be requested and executed.
The larger lesson is about end of service products. Fax and telephony servers tend to be installed once and forgotten, run with high privileges and sit on networks that trust each other. When the vendor stops patching, the only controls left are isolation and replacement. The record does not flag this CVE as listed in CISA KEV.
Quick check
Is there a patch?
I could not confirm one. The product is end of service according to the VulnCheck advisory, so check with AudioCodes and plan to replace it.
What is the fastest safe step?
Block access to the web administration page from everywhere except a small management network, then inspect the host.
Sources
Last reviewed: 18 October 2026.
