sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2025-34333 AudioCodes Fax/IVR Appliance <= 2.6.23 World-Writable Webroot LPE

High 8.5 Published Updated

Local users can escalate privileges to SYSTEM by modifying webroot scripts due to insecure file permissions on AudioCodes Fax/IVR appliances.

Exploited in the wild
Not known
Login needed
Any signed-in user
Attackable
Local or same network only
Victim action needed
Not needed
Fix
None listed

What is CVE-2025-34333?

CVE-2025-34333 is a high-severity vulnerability in AudioCodes Fax/IVR Appliance, published on 19 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 configure the web document root at C:\\F2MAdmin\\F2E with overly permissive file system permissions. Authenticated local users have modify rights on this directory, while the associated web server process runs as NT AUTHORITY\\SYSTEM. As a result, any local user can create or alter server-side scripts within the webroot and then trigger them via HTTP requests, causing arbitrary code to execute with SYSTEM privileges.

Weakness: CWE-276

Which versions are affected by CVE-2025-34333?

It affects 2 products.

Products include Audiocodes Fax Server, Audiocodes Interactive Voice Response.

How do I fix CVE-2025-34333?

No fix has been published for CVE-2025-34333 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-34333 being exploited?

There is no known exploitation of CVE-2025-34333 in the wild and no public exploit code.

Sources

Also known as GHSA-g2p2-cfv2-vc48.

Is CVE-2025-34333 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free