-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID:               SYSS-2026-032
Product:                   AudioCodes One Voice Operations Center (OVOC)
Manufacturer:              AudioCodes Ltd.
Affected Version(s):       <= 8.4.3615, future releases may also be affected (not yet fixed)
Tested Version(s):         8.4.3079 on Rocky Linux 8.10
Vulnerability Type:        Improper Access Control (CWE-284)
Risk Level:                High
Solution Status:           Open
Manufacturer Notification: 2026-04-22
Solution Date:             Not yet fixed
Public Disclosure:         2026-07-09
CVE Reference:             Not yet assigned
Author of Advisory:        Moritz Abrell, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

AudioCodes One Voice Operations Center (OVOC) is a web-based management
and monitoring solution for Session Border Controllers.

The manufacturer describes OVOC as "a voice network management solution"
and states that it combines device management with quality monitoring
(see [1]).

OVOC exposes a tenant deletion endpoint without effective authentication 
or source-IP enforcement.

An unauthenticated attacker can reach the endpoint responsible for deleting 
tenant-related IP Phone Manager data. 
The source code shows that the intended localhost-only guard logs an 
error but does not stop execution because the terminating "die()" statement 
is commented out.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

The vulnerable endpoint is:

    /ipp/admin/httpauth/delete_tenant.php

The corresponding file on the OVOC server is:

    /opt/ACEMS/ippmanager/admin/httpauth/delete_tenant.php

The file defines a localhost allowlist:

    $whitelist = array(
        '127.0.0.1',
        '::1'
    );

It then checks whether the request originates from one of these
addresses. However, the terminating statement is commented out:

    if(!in_array($_SERVER['REMOTE_ADDR'], $whitelist)){
        write_log("new device access not from local host ".
            $_SERVER['REMOTE_ADDR'] ,EasyLogger::ERR);
        //die("Direct access not permitted: new device access not from
        //local host ".$_SERVER['REMOTE_ADDR']);
    }

Execution continues and the "TenantID" parameter is read directly from
the query string:

    $TenantID = $_GET['TenantID'];

The script then performs a deletion cascade for tenant-specific data,
including tenant overwrites, site overwrites, firmware records, IP phone
models, SIP devices, user overwrites, device status data, and users.

The TenantID is an incremental value and therefore enumerable.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

The following request would delete all tenant data without authentication:

    GET /ipp/admin/httpauth/delete_tenant.php?TenantID=<tenant-id>

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

Not yet fixed

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2026-04-17: Vulnerability discovered
2026-04-22: Vulnerability reported to the manufacturer
2026-04-30: Report assigned to the correct department of the manufacturer
2026-05-11: According to the manufacturer, a fix for the vulnerability 
            is planned for the release expected by the end of May
2026-06-29: Request for an update
2026-06-29: Manufacturer response: fix is planned for next maintenance release
2026-07-09: Public disclosure

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] AudioCodes One Voice Operations Center product page
    https://www.audiocodes.com/solutions-products/products/management-products-solutions/one-voice-operations-center
[2] SySS Security Advisory SYSS-2026-032
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2026-032.txt
[3] SySS Responsible Disclosure Policy
    https://www.syss.de/en/responsible-disclosure-policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Moritz Abrell of SySS GmbH.

E-Mail: moritz.abrell@syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Moritz_Abrell.asc
Key Fingerprint: 2927 7EB6 1A20 0679 79E9  87E6 AE0C 9BF8 F134 8B53

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory should be published by the
author.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 4.0
URL: https://creativecommons.org/licenses/by/4.0/deed.en

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEKSd+thogBnl56Yfmrgyb+PE0i1MFAmpN7WAACgkQrgyb+PE0
i1N/0A//Xb5o890VYkiuKqOBq9LqO+vgXrvj3DcLTB+pNXm9ibwx5BDD7DEbZCEc
etR2ovvw1s8ewNw6AYFaIN9Ho1k43zTHPMtuGqBL8hcGh2TGvbxvY37RffUmRvj6
+yctHk3fHcEUL9BE15VagDDJcoo+OPpjsoFIyADS5LigK63+VsscnNpnhgMWAgxd
mnwSeIIrZLY8t4AEkEYzwQLYlI0Xq2S7YF46Sj3sqsePsnTm2AvuQ9g5LKM4tbxM
4VWyhxto+KthBwLf7AuDQZQeo2OF3GVFNgZjk/Zu0aCfqU0Lg0N4Vugom/iNtaOU
Dq1RdMnnlbt7bPMKBgTTFbgyfJY/7ojSW4OFu8kbwAUsypT9epA8U53zt/Kc4yJp
BOtFw7j4Qi72Yx+Ml39tou3R700XUU70KRGyXG/SeYPo6fb2b4duQpNegKEiMU76
rZc34rs4jkjzYfsw/uvgG6BCTHGCCVvHhNkC13NxshsvdqNYHPp3bHnTmzAH8nyN
3oqCGqR5udxr+FyEJn4fX5rAaosk0Ua59oKc+4hNyLOsWKWKEVCKwLbgwZf2EleB
9xgOlgaMY7COvlzQ7/eFb6dMzT5vsWuJekHBVwdb/x7RfTl5Uhh4uO+E8r2FteLF
J+rTsPTba1mrAzuQFq/+Z7IAU4qVD9sFZB7yww/bCm9afi99KaE=
=7IEA
-----END PGP SIGNATURE-----