-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID:               SYSS-2026-031
Product:                   AudioCodes One Voice Operations Center (OVOC)
Manufacturer:              AudioCodes Ltd.
Affected Version(s):       <= 8.4.3615, future releases may also be affected (not yet fixed)
Tested Version(s):         8.4.3079 on Rocky Linux 8.10
Vulnerability Type:        SQL Injection (CWE-89)
Risk Level:                Medium
Solution Status:           Open
Manufacturer Notification: 2026-04-22
Solution Date:             Not yet fixed
Public Disclosure:         2026-07-09
CVE Reference:             Not yet assigned
Author of Advisory:        Moritz Abrell, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

AudioCodes One Voice Operations Center (OVOC) is a web-based management
and monitoring solution for Session Border Controllers.

The manufacturer describes OVOC as "a voice network management solution"
and states that it combines device management with quality monitoring
(see [1]).

OVOC is affected by an authenticated SQL injection vulnerability 
in the IP Phone Manager device status action handler.

An authenticated operator can inject SQL through the "id" POST parameter
used by actions such as "delete" and "approve". The vulnerable code
concatenates the parameter directly into SQL statements.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

The vulnerable endpoint is:

    POST /ipp/admin/AudioCodes_files/ajaxDeviceStatusMultiAction.php

The endpoint requires an authenticated IP Phone Manager session. The
issue was verified with an operator account.

In the "delete" action, the code reads the raw "id" POST parameter and
concatenates it into a DELETE statement:

    $id = $_POST['id'];
    [...]
    $sql = "DELETE FROM IPPHONES_DEVICES_STATUS WHERE ID = " .$id . "";

In the "approve" action, the same pattern is used for a SELECT query:

    $id = $_POST['id'];
    [...]
    $sql = "SELECT MAC, USER_AGENT,USER_ID FROM
            IPPHONES_DEVICES_STATUS WHERE ID = " .$id . "";

The "id" parameter is not cast to an integer and is not bound as a
prepared-statement parameter. The existing authorization helper receives
an already concatenated SQL string and does not remove the injection
primitive.

Consequently, an attacker can alter the SQL syntax. For example, a quote
character causes a PostgreSQL syntax error, while a Boolean expansion
such as "1 OR 1=1" would transform the DELETE condition into a table-wide
operation.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

The following payload shows the impact of the injection and 
would delete all rows in the affected table:

    action=delete&id=1 OR 1=1

Resulting SQL statement:

    DELETE FROM IPPHONES_DEVICES_STATUS WHERE ID = 1 OR 1=1

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

Not yet fixed

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2026-04-17: Vulnerability discovered
2026-04-22: Vulnerability reported to the manufacturer
2026-04-30: Report assigned to the correct department of the manufacturer
2026-05-11: According to the manufacturer, a fix for the vulnerability 
            is planned for the release expected by the end of May
2026-06-29: Request for an update
2026-06-29: Manufacturer response: fix is planned for next maintenance release
2026-07-09: Public disclosure

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] AudioCodes One Voice Operations Center product page
    https://www.audiocodes.com/solutions-products/products/management-products-solutions/one-voice-operations-center
[2] SySS Security Advisory SYSS-2026-031
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2026-031.txt
[3] SySS Responsible Disclosure Policy
    https://www.syss.de/en/responsible-disclosure-policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Moritz Abrell of SySS GmbH.

E-Mail: moritz.abrell@syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Moritz_Abrell.asc
Key Fingerprint: 2927 7EB6 1A20 0679 79E9  87E6 AE0C 9BF8 F134 8B53

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory should be published by the
author.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 4.0
URL: https://creativecommons.org/licenses/by/4.0/deed.en

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEKSd+thogBnl56Yfmrgyb+PE0i1MFAmpN7VcACgkQrgyb+PE0
i1NGvA/+P0rwG/qI3mVavn2Zxm60+xf/vrVd4Ph1og95rnLxQbdYoOBdOfFWvSv8
Tk24WRoo1aPpBpn/b0zhShpHbAWiHQv+tgbmjp3b/WW0gWMowKKGbmoGKhr0RWba
LEHBfrwmSaT7l/ffgXj5S+koMfy54yC3VX0AOE/I6DbqParv1MHI1tRbyKugu6V4
89RJXCcminyXfOIuj9BGOeTW5mp3nBN1AS8aNXERoXFnM/tTMdI0rybbQX94R9oQ
T69mBrdk6FhyGzFTM15GgVQoTpD38cYFA3I8cLZMl536+88Kddl7YrSB5JKCjhv1
oGHQ+iqd/JU6oplPK8FiqK+LJNk6btOnGSWV9qtOpGyy8zvfGEoHcWqIUm0zIQ8J
n7LDZne5xIXPgUmDYtF5G2adD5EB9+FAKjn906CcTYCXh3G6vWhGg6Ga9QEX7a5g
J3vjq9eMwYBeZiw6UYZDNe66KcAAqlXJVRQSN2Wt57nswsjDBObW6w99eazaDS3o
lV1yVSJUx6HH6AixhdJ8yRX0mvk1hjF1jhVJSjzrtyYdJtJKGUAUKMXZi4HodTEI
QV4IXo1NwNz0Ps/laABOr/yI2mp+jAVqvkSq9auNbFuf3Rxf5APjHOmztHsrqikt
TnZ7YOrbMKvH9qQnsfcXPPNN+9R2by052KG6dcAct1tmgtLoDMI=
=6JYI
-----END PGP SIGNATURE-----