CVE-2025-32106

CRITICAL

Audiocodes Mp-112 Firmware < 6.60A.369.002 - Code Injection

Title source: rule

Description

In Audiocodes Mediapack MP-11x through 6.60A.369.002, a crafted POST request request may result in an unauthenticated remote user's ability to execute unauthorized code.

References (3)

Core 3

Core References

Various Sources

https://github.com/austin2111/papers/blob/main/CVE-2025-32105_CVE-2025-32106_Technical_Report.pdf

View Writeup ZIP pw:eip

Product

https://Audiocodes.com

Exploit, Third Party Advisory

https://github.com/austin2111/papers/blob/main/Software_Vulnerabilities_in_Telecommunications_Hardware.pdf

View Exploit ZIP pw:eip

Scores

CVSS v3 9.8

EPSS 0.0234

EPSS Percentile 84.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-94

Status published

Products (3)

audiocodes/mp-112_firmware < 6.60A.369.002

audiocodes/mp-114_firmware < 6.60A.369.002

audiocodes/mp-118_firmware < 6.60A.369.002

Published Jun 03, 2025

Tracked Since Feb 18, 2026