AudioCodes One Voice Operations Center Hard-Coded Key Vulnerability Allowing Decryption of Sensitive Data

A vulnerability exists in AudioCodes One Voice Operations Center (OVOC) versions prior to 8.4.582) that allows an attacker to decrypt sensitive information, including passwords, from the topology file. This issue arises from the use of a hard-coded cryptographic key, which is static, weak, and easily guessable. The vulnerability was discovered by reverse engineering the OVOC server, where the class responsible for the decryption was identified. The decrypted passwords can include administrative credentials for assigned devices, such as Session Border Controllers.

Impact

Exploitation of this vulnerability allows for the decryption of sensitive data, such as passwords, from the OVOC topology files. This could lead to unauthorized access to managed devices, including Session Border Controllers.

Reproduction

To reproduce this vulnerability, first extract the OVOC server.jar file and reverse engineer it to find the hard-coded decryption key and initialization vector (IV). The key and IV can be used to decrypt encrypted passwords found in the topology files 'topology.xml' and 'MGsTopologyList.csv', which contain administrative passwords for assigned devices.

Remediation

Users are advised to update to AudioCodes One Voice Operations Center version 8.4.582.