AudioCodes Fax Server and Auto-Attendant IVR Appliances World-Writable Webroot Local Privilege Escalation Vulnerability

A vulnerability exists in AudioCodes Fax Server and Auto-Attendant IVR appliances in versions through 2.6.23. These appliances set the web document root to C:\F2MAdmin\F2E with excessively permissive file system permissions. This misconfiguration allows authenticated local users to modify files in this directory. Since the web server process operates under the NT AUTHORITY\SYSTEM account, any scripts created or altered by local users can be executed via HTTP requests, leading to arbitrary code execution with SYSTEM privileges.

Impact

Exploitation of this vulnerability allows authenticated local users to execute arbitrary code with SYSTEM privileges on the affected appliance.