CVE-2023-22955

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. The validation of firmware images only consists of simple checksum checks for different firmware components. Thus, by knowing how to calculate and where to store the required checksums for the flasher tool, an attacker is able to store malicious firmware.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-345

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
audiocodes_ltd	voip_phones	< 3.4.4.1000

References

http://packetstormsecurity.com/files/174214/AudioCodes-VoIP-Phones-Insufficient-Firmware-Validation.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2023/Aug/17Mailing List, Third Party Advisory
https://syss.deNot Applicable
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-055.txtExploit, Vendor Advisory
http://packetstormsecurity.com/files/174214/AudioCodes-VoIP-Phones-Insufficient-Firmware-Validation.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2023/Aug/17Mailing List, Third Party Advisory
https://syss.deNot Applicable
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-055.txtExploit, Vendor Advisory

Timeline

Published: Aug 11, 2023
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-229567.5An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of a hard-coded cryptographic key, an attacker is CVE-2023-229577.5An issue was discovered in libac_des3.so on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of hard-coded cryptographic key, CVE-2023-229586.1The Syracom Secure Login plugin before 3.1.1.0 for Jira may allow spoofing of 2FA PIN validation via the plugins/servlet/twofactor/public/pi CVE-2023-229598.8WebChess through 0.9.0 and 1.0.0.rc2 allows SQL injection: mainmenu.php, chess.php, and opponentspassword.php (txtFirstName, txtLastName).CVE-2023-22966.1The Loginizer WordPress plugin before 1.7.9 does not escape a parameter before outputting it back in the page, leading to a Reflected Cross-CVE-2023-229607.5Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency.CVE-2023-229635.3The personnummer implementation before 3.0.3 for Dart mishandles numbers in which the last four digits match the ^000[0-9]$ regular expressi CVE-2023-229649.1Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication i CVE-2023-22978.1The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions CVE-2023-229707.8Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file.CVE-2023-229716.1Cross Site Scripting (XSS) vulnerability in Hughes Network Systems Router Terminal for HX200 v8.3.1.14, HX90 v6.11.0.5, HX50L v6.10.0.18, HN CVE-2023-229725.4A Reflected Cross-site scripting (XSS) vulnerability in interface/forms/eye_mag/php/eye_mag_functions.php in OpenEMR < 7.0.0 allows remote a