Audiocodes vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-34335 AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an authenticated command injection vulnerability in the licenHigh 8.7 · Nov 19, 2025
• CVE-2025-34334 AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 are vulnerable to an authenticated command injection in the fax testHigh 8.7 · Nov 19, 2025
• CVE-2025-34333 AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 configure the web document root at C:\\F2MAdmin\\F2E with overly perHigh 8.5 · Nov 19, 2025
• CVE-2025-34332 AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component that controls back-end WindowHigh 8.5 · Nov 19, 2025
• CVE-2025-34331 AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 contain an unauthenticated file read vulnerability via the download.High 8.7 · Nov 19, 2025
• CVE-2025-34329 AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodes_filesCritical 9.3 · Nov 19, 2025
• CVE-2025-34328 AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an unCritical 9.3 · Nov 19, 2025
• CVE-2025-32106 In Audiocodes Mediapack MP-11x through 6.60A.369.002, a crafted POST request request may result in an unauthenticated remote user's ability to execute unauthoriCritical 9.8 · Jun 3, 2025
• CVE-2024-52884 An issue was discovered in AudioCodes Mediant Session Border Controller (SBC) before 7.40A.501.841.High 7.5 · Feb 7, 2025
• CVE-2024-52883 An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582.High 7.5 · Feb 7, 2025
• CVE-2024-52881 An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582.High 7.5 · Feb 7, 2025
• CVE-2022-24630 An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752.High 7.2 · May 29, 2023
• CVE-2022-24629 An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752.Critical 9.8 · May 29, 2023
• CVE-2022-24628 An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752.High 7.2 · May 29, 2023
• CVE-2022-24627 An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752.Critical 9.8 · May 29, 2023
• CVE-2019-9229 An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.251.High 8.8 · Jul 19, 2019
• CVE-2019-9228 An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A at least to 7.20A.252.062.High 7.5 · Jul 19, 2019
• CVE-2019-9231 An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions before 7.20A.202.307.High 8.8 · Jul 18, 2019
• CVE-2018-16219 A missing password verification in the web interface in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an remote attacker (in the same network as the dHigh 8.8 · Apr 25, 2019
• CVE-2018-16216 A command injection (missing input validation, escaping) in the monitoring or memory status web interface in AudioCodes 405HD (firmware 2.2.12) VoIP phone allowHigh 8 · Apr 25, 2019
• CVE-2018-5757 An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106.High 8.8 · Apr 1, 2019
• CVE-2018-10093 AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution.High 8.8 · Mar 21, 2019