EUVD-2025-198196

Comprehensive Technical Analysis of EUVD-2025-198196

1. Vulnerability Assessment and Severity Evaluation

The vulnerability described in EUVD-2025-198196 affects AudioCodes Fax Server and Auto-Attendant IVR appliances up to and including version 2.6.23. The web administration component (F2MAdmin) exposes an unauthenticated script-management endpoint, allowing remote attackers to write arbitrary files to the server-side file path with elevated privileges. This vulnerability is severe due to the following factors:

• Unauthenticated Access: The endpoint does not require authentication, making it accessible to any attacker.
• Elevated Privileges: The web service runs as NT AUTHORITY\SYSTEM on Windows deployments, granting the attacker high-level access.
• Arbitrary File Write: Attackers can write files to the web-accessible directory structure, leading to potential remote code execution (RCE).

The CVSS Base Score of 9.3 indicates a critical vulnerability. The vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N highlights the following:

• Attack Vector (AV:N): Network-based attack.
• Attack Complexity (AC:L): Low complexity required.
• Privileges Required (PR:N): No privileges required.
• User Interaction (UI:N): No user interaction required.
• Confidentiality (VC:H), Integrity (VI:H), Availability (VA:H): High impact on all three.

2. Potential Attack Vectors and Exploitation Methods

Attackers can exploit this vulnerability through the following methods:

• Unauthenticated File Upload: By sending a crafted HTTP request to the ajaxScript.php endpoint, attackers can upload malicious files to the server.
• Remote Code Execution (RCE): Once a malicious file is uploaded, attackers can execute it, leading to full control over the affected system.
• Persistent Access: Attackers can maintain persistent access by uploading backdoors or other malicious scripts.

3. Affected Systems and Software Versions

The vulnerability affects:

• AudioCodes Fax Server and Auto-Attendant IVR appliances
• Versions: Up to and including 2.6.23

4. Recommended Mitigation Strategies

To mitigate this vulnerability, organizations should:

• Update Software: Immediately update to a patched version of the software if available.
• Network Segmentation: Isolate affected appliances from critical networks to limit potential damage.
• Access Controls: Implement strict access controls and monitoring for the web administration interface.
• Intrusion Detection: Deploy intrusion detection systems (IDS) to monitor for suspicious activity related to the ajaxScript.php endpoint.
• Regular Audits: Conduct regular security audits and vulnerability assessments.

5. Impact on European Cybersecurity Landscape

This vulnerability poses a significant risk to European organizations using AudioCodes Fax Server and Auto-Attendant IVR appliances. The potential for unauthenticated RCE can lead to data breaches, service disruptions, and financial losses. Organizations in critical sectors such as healthcare, finance, and government are particularly at risk.

6. Technical Details for Security Professionals

Vulnerability Details:

• Endpoint: AudioCodes_files/utils/IVR/diagram/ajaxScript.php
• Action: saveScript
• Privileges: NT AUTHORITY\SYSTEM on Windows

Exploitation Steps:

1. Identify Target: Locate the vulnerable endpoint on the target system.
2. Craft Request: Create a malicious HTTP request to the ajaxScript.php endpoint with the saveScript action.
3. Upload File: Include the payload in the request to write a malicious file to the server.
4. Execute Payload: Trigger the execution of the uploaded file to gain control over the system.

Detection and Response:

• Log Analysis: Monitor web server logs for unusual activity related to the ajaxScript.php endpoint.
• File Integrity Monitoring: Implement file integrity monitoring to detect unauthorized file changes.
• Incident Response: Have an incident response plan in place to quickly address any detected exploitation attempts.

References:

• NVD Entry
• Pierre Kim Advisory
• Pierre Kim Blog
• AudioCodes Product Notice
• VulnCheck Advisory

By addressing this vulnerability promptly and implementing robust security measures, organizations can significantly reduce the risk of exploitation and protect their critical assets.