-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID:               SYSS-2026-030
Product:                   AudioCodes One Voice Operations Center (OVOC)
Manufacturer:              AudioCodes Ltd.
Affected Version(s):       < 8.4.3615
Tested Version(s):         8.4.3079 on Rocky Linux 8.10
Vulnerability Type:        Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Risk Level:                Medium
Solution Status:           Fixed
Manufacturer Notification: 2026-04-22
Solution Date:             2026-06-21
Public Disclosure:         2026-07-09
CVE Reference:             Not yet assigned
Author of Advisory:        Moritz Abrell, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

AudioCodes One Voice Operations Center (OVOC) is a web-based management
and monitoring solution for Session Border Controllers.

The manufacturer describes OVOC as "a voice network management solution"
and states that it combines device management with quality monitoring
(see [1]).

OVOC exposes sensitive files below the public "/ipp" web path. 
Unauthenticated attackers can download environment files, backup PHP 
source files, and Composer dependency metadata.

The exposed files include database and integration credentials as well
as source code for authentication and session handling routines.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

The Apache configuration exposes the IP Phone Manager application tree
through the following alias:

    Alias /ipp "/opt/ACEMS/ippmanager/"

The corresponding directory block grants unauthenticated access:

    <Directory "/opt/ACEMS/ippmanager">
        Options -Indexes
        AllowOverride All
        Require all granted
        DirectoryIndex AudioCodes.php
    </Directory>

Some rewrite rules block selected file types such as ".cfg", ".log",
".ini", and ".csv" below "/ipp/admin/AudioCodes_files/". However, the
rules do not block environment files, backup PHP source files, Composer
metadata, or other sensitive application artifacts.

As a result, sensitive files are directly reachable through HTTPS. The
following files were confirmed to be exposed without authentication on
the tested installation:

    /ipp/.env
    /ipp/admin/AudioCodes_files/functions.php.bak
    /ipp/admin/AudioCodes_files/protect.php.bak
    /ipp/admin/AudioCodes_files/composer/composer.lock

The ".env" file contained, among other values:

    PSQL_DB_PASS=<database password>
    REST_USER=<REST integration user>
    REST_PASS=<REST integration password>

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

GET /ipp/.env
HTTP 200, 531 bytes

GET /ipp/admin/AudioCodes_files/functions.php.bak
HTTP 200, 44496 bytes

GET /ipp/admin/AudioCodes_files/protect.php.bak
HTTP 200, 16357 bytes

GET /ipp/admin/AudioCodes_files/composer/composer.lock
HTTP 200, 25637 bytes

Example request:
    curl -k https://<host>/ipp/.env

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

Update to version 8.4.3615 according to the manufacturer.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2026-04-17: Vulnerability discovered
2026-04-22: Vulnerability reported to the manufacturer
2026-04-30: Report assigned to the correct department of the manufacturer
2026-05-11: According to the manufacturer, a fix for the vulnerability 
            is planned for the release expected by the end of May
2026-06-29: Request for an update
2026-06-29: Manufacturer response: vulnerability is fixed in version 8.4.3615
2026-07-09: Public disclosure

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] AudioCodes One Voice Operations Center product page
    https://www.audiocodes.com/solutions-products/products/management-products-solutions/one-voice-operations-center
[2] SySS Security Advisory SYSS-2026-030
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2026-030.txt
[3] SySS Responsible Disclosure Policy
    https://www.syss.de/en/responsible-disclosure-policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Moritz Abrell of SySS GmbH.

E-Mail: moritz.abrell@syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Moritz_Abrell.asc
Key Fingerprint: 2927 7EB6 1A20 0679 79E9  87E6 AE0C 9BF8 F134 8B53

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory should be published by the
author.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 4.0
URL: https://creativecommons.org/licenses/by/4.0/deed.en

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEKSd+thogBnl56Yfmrgyb+PE0i1MFAmpN7U0ACgkQrgyb+PE0
i1P/ohAAq9clvTfY6NDGhYt3LJHOPLD1SWtcZ21q/zo5ZKkFtPtaMdxnTKBULtNH
u9maEqSWgxw+PQWtl+nf6ldMXc00Aavhi855IBxrsyhbsq3qRlTOBIgP0DJsniiz
rCXgjGQo36xdViZCtcVuo3yr42f1K87Wv08T3pbej/e3hVrNHSQaiPCsmyxa0d6S
EO1z4EK7h/CklBY28J78cQqqq3LWOQ9bKcAqRBrp5RWsTbLw8yMUeTERPEQ8DzhA
LFO+z/iUIWquMHitIZFhDZV6PeJv6KVhwgY9D7F37ltT4pj+C5rzV7tTDykWYSZd
RjNS7ZzcbUnsUcUqM0+j4voHHRGqogBBPBIqXxwR3vXT8Hcm7chaBWnQrCNiT9yf
++UW+V7aHM4sU9hHQp89rxW5HkeRgBh1OCxk5FsSFMylmqTgOYu45iz51mvmuFCW
X8//yVQdNFfGL73D6hZh5sBQbVHt4kG/+eoFtbyhuDw86C74yBlOB2E78RRDSWC7
M7evKvqmiqVFuczwdLFtrRBoc4RjGficeH3fAA+6Y/AB7WA6g+hqYHjjZSsA9qew
+5b/TWglnwAW+W4Gal49gCvLYckzb6/TJ1hr+dVbWQoCtw5ZepJBEExy/oUTqYAn
KHv3/S5QHCdHUeoI/V+8B/pMbgub8gtyuRsNazUglZqdz1oxMx8=
=jgOq
-----END PGP SIGNATURE-----