AudioCodes vulnerabilities
We track 18 vulnerabilities in AudioCodes products across 16 products. 18 are rated high or critical, and none are known to be exploited. The most recent was published on November 19, 2025.
Latest AudioCodes vulnerabilities
- 8.8 High severity
AudioCodes Fax/IVR Appliance: Improper Neutralization of Special Elements used in an OS Command
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an authenticated command injection vulnerability in the license activation workflow handled by AudioCodes_files/ActivateLicense.php. When a license file is uploa
- 8.8 High severity
AudioCodes Fax/IVR Appliance: Improper Neutralization of Special Elements used in an OS Command
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 are vulnerable to an authenticated command injection in the fax test functionality implemented by AudioCodes_files/TestFax.php. When a fax "send" test is requested, the
- 7.8 High severity
AudioCodes Fax/IVR Appliance: Incorrect Default Permissions
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 configure the web document root at C:\\F2MAdmin\\F2E with overly permissive file system permissions. Authenticated local users have modify rights on this directory, whi
- 7.8 High severity
AudioCodes Fax/IVR Appliance: Incorrect Default Permissions
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component that controls back-end Windows services using helper batch scripts located under C:\\F2MAdmin\\F2E\\AudioCodes_files\\utils\\Serv
- 7.5 High severity
AudioCodes Fax/IVR Appliance: Missing Authentication for Critical Functionality
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 contain an unauthenticated file read vulnerability via the download.php script. The endpoint exposes a file download mechanism that lacks access control, allowing remot
- 9.8 Critical severity
AudioCodes Fax/IVR Appliance: Unrestricted Upload of File with Dangerous Type
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodes_files/ajaxBackupUploadFile.php in the F2MAdmin web interface. The script derives a backup folder path fro
- 9.8 Critical severity
AudioCodes Fax/IVR Appliance: Unrestricted Upload of File with Dangerous Type
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an unauthenticated script-management endpoint at AudioCodes_files/utils/IVR/diagram/ajaxScript.php. The s
- 9.8 Critical severity
Mp-112 Firmware: Improper Control of Generation of Code
In Audiocodes Mediapack MP-11x through 6.60A.369.002, a crafted POST request request may result in an unauthenticated remote user's ability to execute unauthorized code.
- 7.5 High severity
Mediant Session Border Controller: Use of a Broken or Risky Cryptographic Algorithm
An issue was discovered in AudioCodes Mediant Session Border Controller (SBC) before 7.40A.501.841. Due to the use of weak password obfuscation/encryption, an attacker with access to configuration exports (INI) is able to decrypt the passwords.
- 7.5 High severity
One Voice Operations Center: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to a path traversal vulnerability, sensitive data can be read without any authentication.
- 7.5 High severity
One Voice Operations Center: Use of Hard-coded Cryptographic Key
An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to the use of a hard-coded key, an attacker is able to decrypt sensitive data such as passwords extracted from the topology file.
- 7.5 High severity
voip_phones: Use of Hard-coded Credentials
An issue was discovered in libac_des3.so on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of hard-coded cryptographic key, an attacker with access to backup or configuration files is able to decrypt encrypted values and retrieve sensitive info
- 7.5 High severity
voip_phones: Use of Hard-coded Credentials
An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of a hard-coded cryptographic key, an attacker is able to decrypt encrypted configuration files and retrieve sensitive information.
- 7.8 High severity
voip_phones: Insufficient Verification of Data Authenticity
An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. The validation of firmware images only consists of simple checksum checks for different firmware components. Thus, by knowing how to calculate and where to store the required checksums
- 7.2 High severity
Device Manager Express: Improper Neutralization of Special Elements used in a Command
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. BrowseFiles.php allows a ?cmd=ssh POST request with an ssh_command field that is executed.
- 9.8 Critical severity
Device Manager Express: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achieved via directory traversal in the dir parameter of the file upload functionality of BrowseFiles.php. An attacker can upload a .php file to
- 7.2 High severity
Device Manager Express: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is authenticated SQL injection in the id parameter of IPPhoneFirmwareEdit.php.
- 9.8 Critical severity
Device Manager Express: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the process_login.php login form.