Fax Server vulnerabilities
7 known vulnerabilities in Fax Server from AudioCodes. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
AudioCodes Fax/IVR Appliance: Improper Neutralization of Special Elements used in an OS Command
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an authenticated command injection vulnerability in the license activation workflow handled by AudioCodes_files/ActivateLicense.php. When a license file is uploa
- 8.8 High severity
AudioCodes Fax/IVR Appliance: Improper Neutralization of Special Elements used in an OS Command
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 are vulnerable to an authenticated command injection in the fax test functionality implemented by AudioCodes_files/TestFax.php. When a fax "send" test is requested, the
- 7.8 High severity
AudioCodes Fax/IVR Appliance: Incorrect Default Permissions
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 configure the web document root at C:\\F2MAdmin\\F2E with overly permissive file system permissions. Authenticated local users have modify rights on this directory, whi
- 7.8 High severity
AudioCodes Fax/IVR Appliance: Incorrect Default Permissions
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component that controls back-end Windows services using helper batch scripts located under C:\\F2MAdmin\\F2E\\AudioCodes_files\\utils\\Serv
- 7.5 High severity
AudioCodes Fax/IVR Appliance: Missing Authentication for Critical Functionality
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 contain an unauthenticated file read vulnerability via the download.php script. The endpoint exposes a file download mechanism that lacks access control, allowing remot
- 9.8 Critical severity
AudioCodes Fax/IVR Appliance: Unrestricted Upload of File with Dangerous Type
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodes_files/ajaxBackupUploadFile.php in the F2MAdmin web interface. The script derives a backup folder path fro
- 9.8 Critical severity
AudioCodes Fax/IVR Appliance: Unrestricted Upload of File with Dangerous Type
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an unauthenticated script-management endpoint at AudioCodes_files/utils/IVR/diagram/ajaxScript.php. The s