CVE-2023-22955

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-08-11 · updated 2026-06-17
Weakness: CWE-345

Description

An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. The validation of firmware images only consists of simple checksum checks for different firmware components. Thus, by knowing how to calculate and where to store the required checksums for the flasher tool, an attacker is able to store malicious firmware.

Affected products

Audiocodes 405Hd Firmware: through 3.4.4.1000
Audiocodes 445Hd Firmware: through 3.4.4.1000
Audiocodes C450Hd Firmware: through 3.4.4.1000

References

http://packetstormsecurity.com/files/174214/AudioCodes-VoIP-Phones-Insufficient-Firmware-Validation.html
http://seclists.org/fulldisclosure/2023/Aug/17
https://syss.de
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-055.txt
http://packetstormsecurity.com/files/174214/AudioCodes-VoIP-Phones-Insufficient-Firmware-Validation.html
http://seclists.org/fulldisclosure/2023/Aug/17
https://syss.de
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-055.txt

Get alerted when CVE-2023-22955 or the next vulnerability affects your stack