AudioCodes Fax Server and Auto-Attendant IVR Unauthenticated File Upload Vulnerability

A vulnerability exists in AudioCodes Fax Server and Auto-Attendant IVR appliances in versions through 2.6.23. The issue arises from a web administration component that provides an unauthenticated file upload endpoint. This endpoint accepts files and saves them in a temporary directory without any authentication, authorization, or file-type validation. As a result, a remote, unauthenticated attacker could upload or overwrite files related to prompts or music-on-hold, potentially disrupting IVR audio content or setting the stage for further attacks.

Impact

Exploitation of this vulnerability could lead to unauthorized modification of IVR audio files, allowing attackers to disrupt service or manipulate content for malicious purposes.