SecBoard
Zurück zur CVE-Übersicht

CVE-2025-34332

HIGH(7.8)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score20/100 — NIEDRIG
  • CVSS 7.8 — Hoch

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.8

Technische Schwere

Beschreibung

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component that controls back-end Windows services using helper batch scripts located under C:\\F2MAdmin\\F2E\\AudioCodes_files\\utils\\Services. When certain service actions are requested through ajaxPost.php, these scripts are invoked by PHP using system() under the NT AUTHORITY\\SYSTEM account. The batch files in this directory are writable by any authenticated local user due to overly permissive ACLs, allowing them to replace script contents with arbitrary commands. On the next service start/stop operation, the modified script is executed as SYSTEM, enabling elevation of local privileges.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

This query detects attempts to modify batch scripts in the specified directory, which could indicate an attempt to exploit CVE-2025-34332. It requires monitoring file system events for modifications to .bat files under C:\F2MAdmin\F2E\AudioCodes_files\utils\Services.

Sentinel/Defender KQL

DeviceFileEvents
| where FolderPath contains "C:\\F2MAdmin\\F2E\\AudioCodes_files\\utils\\Services" and FileName endswith ".bat"
| where ActionType == "FileModified" or ActionType == "FileCreated"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, SHA256

Splunk SPL

index=* sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=11 Image="*php.exe" TargetFilename="C:\\F2MAdmin\\F2E\\AudioCodes_files\\utils\\Services\\*.bat" OR TargetFilename="C:\\F2MAdmin\\F2E\\AudioCodes_files\\utils\\Services\\*.cmd" | table _time, host, Image, TargetFilename, User

Sigma

title: AudioCodes Fax/IVR LPE Attempt
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects attempts to modify service control batch scripts in AudioCodes Fax/IVR Appliance, indicating a potential local privilege escalation attempt (CVE-2025-34332).
author: SecBoard
date: 2025/01/01
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains: 'C:\\F2MAdmin\\F2E\\AudioCodes_files\\utils\\Services\\'
    TargetFilename|endswith: ['.bat', '.cmd']
    EventCode: 11 # Sysmon Event ID for FileCreate, FileCreateStreamHash, FileDelete, FileRename, FileChange
  condition: selection
fields:
  - Image
  - TargetFilename
  - User
tags:
  - attack.privilege_escalation
  - cve.2025.34332

Elastic ES|QL

file where file.path : "C:\\F2MAdmin\\F2E\\AudioCodes_files\\utils\\Services\\*.bat" or file.path : "C:\\F2MAdmin\\F2E\\AudioCodes_files\\utils\\Services\\*.cmd" and event.action : ("file_create", "file_change")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Domains (1)

  • downloads-audiocodes.s3.eu-central-1.amazonaws.com

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Betroffene Produkte

  • cpe:2.3:a:audiocodes:fax_server:*:*:*:*:*:*:*:*
  • cpe:2.3:a:audiocodes:interactive_voice_response:*:*:*:*:*:*:*:*

Referenzen