CVE-2025-34329 is a critical flaw (CVSS 9.8) in AudioCodes Fax Server and Auto-Attendant IVR appliances up to and including 2.6.23. An unauthenticated backup upload endpoint accepts files with attacker chosen names, which can lead to command execution. The product is end of service and no fix is confirmed. Isolate it.
What's affected
Per the record, AudioCodes Fax Server and Auto-Attendant IVR appliances up to and including 2.6.23 are affected. The vulnerable file is ajaxBackupUploadFile.php in the F2MAdmin web interface.
The VulnCheck advisory states the product was declared End-of-Service on 31 December 2024. I could not confirm a fixed version. Check the AudioCodes end of service notice linked from the record, and ask your reseller.
This is a sibling of CVE-2025-34328, which affects the same product and versions through a different endpoint. Closing one hole does not close the other, so treat the product as a whole as unsafe on untrusted networks.
How to check if you're exposed
Start by finding the product in your inventory. Search for AudioCodes Fax Server or Auto-Attendant IVR, and look for hosts running the F2MAdmin web interface.
Then test reachability. From a host outside the management network, see whether the admin interface answers. The endpoint described in the record needs no authentication, so any path to the web port counts as exposure.
The record explains that on default Windows deployments the backup directory resolves to the system drive, and that uploaded configuration files can cause an ordinary log file to be treated as code. Because of that, review the web server and interpreter configuration files on the host and compare them with a known good copy. Unexpected changes are a red flag, and your incident process should take over if you find any.
What to do now
- Block access to the web administration interface from every network except a small, controlled management segment.
- Never publish the interface on the internet, and remove any port forwards that lead to it.
- Compare web server and interpreter configuration files and the web directory against a clean baseline, and investigate differences.
- Review logins, new services and unusual outbound traffic from the host.
- Replace the product. It is out of service, and the researcher published several related issues. Ask AudioCodes about a supported alternative.
Why it matters
The class is CWE-434 (Unrestricted Upload of File with Dangerous Type). The script builds a destination folder from configuration, creates it if needed, and moves the uploaded file there under the filename the caller chose. It performs no authentication, no authorization and no check on file type.
What makes this record interesting is the route to code execution. The attacker does not need to upload a script. Uploading a configuration file that changes how the web server or interpreter handles another file is enough, according to the advisory. That means a blocklist of dangerous extensions would not have saved it. Only authentication, a fixed destination and a strict allow list of names would. The record does not list the CVE in CISA KEV.
Quick check
How is this different from CVE-2025-34328?
Same product and versions, different endpoint. One uses the script management page, the other the backup upload page.
Can I just block uploads at a firewall?
A firewall rule that limits who can reach the admin page is the best step available. The proper answer is to retire the product.
Sources
Last reviewed: 18 October 2026.
