CVE-2025-34334: fax server through 2.6.23 (inclusive); +2 more affected products

Affected technology

fax server · through 2.6.23 (inclusive)
audiocodes

interactive voice response · through 2.6.23 (inclusive)
audiocodes

AudioCodes Fax/IVR Appliance · 0 through 2.6.23
AudioCodes Limited

Description’s affected range: versions up to and including 2.6.23

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated attacker with access to the fax test interface can craft parameter values that inject additional shell commands into the generated batch file, leading to arbitrary command execution with SYSTEM privileges. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.