CVE-2025-34334

HighPublic PoCRCE

Published: 19 November 2025

Published

19 November 2025

Modified

11 December 2025

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0022 44.1th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-34334 is a high-severity OS Command Injection (CWE-78) vulnerability in Audiocodes Fax Server. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Windows Command Shell (T1059.003); ranked at the 44.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-6 (Configuration Settings).

Threat & Defense at a Glance

What attackers do: exploitation maps to Windows Command Shell (T1059.003) and 4 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Validates attacker-supplied parameters in the fax test functionality to prevent command injection into the generated batch file.

AC-6 Least Privilege good match

prevent

Enforces least privilege on the backend service to prevent arbitrary command execution with NT AUTHORITY\SYSTEM privileges even if injection occurs.

CM-6 Configuration Settings good match

prevent

Establishes secure configuration settings for the temporary run directory to restrict overly permissive file system permissions and block low-privilege user modifications.

MITRE ATT&CK Enterprise TechniquesAI

T1059.003 Windows Command Shell Execution

Adversaries may abuse the Windows command shell for execution.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1210 Exploitation of Remote Services Lateral Movement

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

attack.mitre.org →

T1574.010 Services File Permissions Weakness Stealth

Adversaries may execute their own malicious payloads by hijacking the binaries used by services.

attack.mitre.org →

Why these techniques?

Authenticated command injection in web interface enables Windows Command Shell execution (T1059.003) and remote exploitation (T1190, T1210) leading to SYSTEM privilege escalation (T1068); permissive temp directory facilitates file system permissions abuse (T1044).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 are vulnerable to an authenticated command injection in the fax test functionality implemented by AudioCodes_files/TestFax.php. When a fax "send" test is requested, the application builds a faxsender…

command line using attacker-supplied parameters and passes it to GlobalUtils::RunBatchFile without proper validation or shell-argument sanitization. The resulting batch file is written into a temporary run directory and then executed via a backend service that runs as NT AUTHORITY\\SYSTEM. An authenticated attacker with access to the fax test interface can craft parameter values that inject additional shell commands into the generated batch file, leading to arbitrary command execution with SYSTEM privileges. In addition, because the generated batch files reside in a location with overly permissive file system permissions, a local low-privilege user on the server can modify pending batch files to achieve the same elevation.

Deeper analysisAI

CVE-2025-34334 is an authenticated command injection vulnerability (CWE-78) with a CVSS score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) affecting AudioCodes Fax Server and Auto-Attendant IVR appliances in versions up to and including 2.6.23. The flaw exists in the fax test functionality implemented by AudioCodes_files/TestFax.php, where the application builds a faxsender command line using attacker-supplied parameters and passes it to GlobalUtils::RunBatchFile without proper validation or shell-argument sanitization. The resulting batch file is written to a temporary run directory and executed via a backend service running as NT AUTHORITY\SYSTEM.

An authenticated attacker with access to the fax test interface can exploit this by crafting parameter values that inject additional shell commands into the generated batch file, enabling arbitrary command execution with SYSTEM privileges. Furthermore, the temporary run directory has overly permissive file system permissions, allowing a local low-privilege user on the server to modify pending batch files and achieve the same privilege escalation to SYSTEM.

Advisories from Pierre Kim and VulnCheck detail the vulnerability and its exploitation mechanics, while AudioCodes has published a product notice announcing end-of-service for the Auto-Attendant IVR solution. No patches are referenced for affected versions.