CVE-2025-34330 AudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated Prompt File Upload via ajaxPromptUploadFile.php
Unauthenticated attackers can upload arbitrary files to the IVR appliance, enabling tampering with audio content or facilitating further attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34330?
CVE-2025-34330 is a medium-severity vulnerability in AudioCodes Fax/IVR Appliance, published on 19 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an unauthenticated prompt upload endpoint at AudioCodes_files/utils/IVR/diagram/ajaxPromptUploadFile.php. The script accepts an uploaded file and writes it into the C:\\F2MAdmin\\tmp directory using a filename derived from application constants, without any authentication, authorization, or file-type validation. A remote, unauthenticated attacker can upload or overwrite prompt- or music-on-hold–related files in this directory, potentially leading to tampering with IVR audio content or preparing files for use in further attacks.
Weakness: CWE-434
Which versions are affected by CVE-2025-34330?
It affects 2 products.
Products include Audiocodes Fax Server, Audiocodes Interactive Voice Response.
How do I fix CVE-2025-34330?
No fix has been published for CVE-2025-34330 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-34330 being exploited?
There is no known exploitation of CVE-2025-34330 in the wild and no public exploit code.
Other vulnerabilities in AudioCodes Fax/IVR Appliance
- CVE-2025-34328 AudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated File Upload RCE via ajaxScript.php
- CVE-2025-34329 AudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated Backup Upload RCE via ajaxBackupUploadFile.php
- CVE-2025-34331 AudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated File Read via download.php
- CVE-2025-34334 AudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via TestFax.php & LPE
- CVE-2025-34335 AudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via ActivateLicense.php
Sources
Also known as GHSA-xwgw-x6p5-hcp9.