CyberRota Analysis
This is a critical severity vulnerability with a CVSS score of 9.8. It affects Windows. It may be remotely exploitable. Exploitation may require the attacker to be authenticated.
Original NVD Description
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an unauthenticated script-management endpoint at AudioCodes_files/utils/IVR/diagram/ajaxScript.php. The saveScript action writes attacker-supplied data directly to a server-side file path under the privileges of the web service account, which runs as NT AUTHORITY\\SYSTEM on Windows deployments. A remote, unauthenticated attacker can write arbitrary files into the product’s web-accessible directory structure and subsequently execute them.
Related CVEs
Other vulnerabilities affecting the same vendor(s)