CVE-2025-32106: Audiocodes MP-112 Firmware RCE Vulnerability

CVE-2025-32106 Overview

CVE-2025-32106 is a critical remote code execution vulnerability affecting Audiocodes Mediapack MP-11x series devices through firmware version 6.60A.369.002. The vulnerability allows an unauthenticated remote attacker to execute arbitrary code on vulnerable devices by sending specially crafted POST requests. This firmware vulnerability in telecommunications hardware poses significant risks to enterprise voice infrastructure and unified communications deployments.

Critical Impact

Unauthenticated remote attackers can achieve complete system compromise on affected Audiocodes Mediapack devices, potentially allowing full control over voice gateway infrastructure, call interception, and lateral movement within enterprise networks.

Affected Products

• Audiocodes MP-112 with firmware through version 6.60A.369.002
• Audiocodes MP-114 with firmware through version 6.60A.369.002
• Audiocodes MP-118 with firmware through version 6.60A.369.002

Discovery Timeline

• 2025-06-03 - CVE-2025-32106 published to NVD
• 2025-06-18 - Last updated in NVD database

Technical Details for CVE-2025-32106

Vulnerability Analysis

This vulnerability (classified as CWE-94: Improper Control of Generation of Code, also known as Code Injection) exists within the web management interface of Audiocodes Mediapack MP-11x series devices. The flaw allows remote attackers to inject and execute malicious code without requiring authentication, making it particularly dangerous for internet-exposed devices.

The vulnerability stems from improper handling of user-supplied input in HTTP POST request processing. When the device's web interface receives a crafted POST request, it fails to properly validate and sanitize the input data before processing, allowing an attacker to inject executable code that runs with the privileges of the underlying system.

Audiocodes Mediapack devices are commonly deployed as VoIP gateways in enterprise telecommunications environments, meaning successful exploitation could compromise critical voice communications infrastructure and provide attackers with a foothold for further network penetration.

Root Cause

The root cause of CVE-2025-32106 is insufficient input validation in the firmware's HTTP request handler. The web management interface accepts POST request parameters without adequate sanitization, allowing code injection payloads to be processed and executed by the system. This represents a fundamental failure in implementing secure input handling practices within the embedded firmware.

Attack Vector

The attack vector for this vulnerability is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying an exposed Audiocodes Mediapack MP-11x device on the network
2. Crafting a malicious POST request containing code injection payload
3. Sending the request to the device's web management interface
4. Achieving code execution with system-level privileges on the target device

The vulnerability mechanism involves improper input sanitization in the HTTP POST request handler. When a specially crafted request is received, the device fails to validate input parameters before processing, allowing injected code to execute within the system context. For detailed technical analysis, refer to the GitHub Technical Report on CVE-2025-32105 and CVE-2025-32106.

Detection Methods for CVE-2025-32106

Indicators of Compromise

• Unusual HTTP POST requests to Audiocodes device management interfaces with unexpected parameter values or encoding
• Anomalous process execution or network connections originating from Audiocodes Mediapack devices
• Unexpected configuration changes or firmware modifications on MP-11x series devices
• Evidence of lateral movement attempts from voice gateway network segments

Detection Strategies

• Deploy network monitoring to inspect HTTP traffic destined for Audiocodes Mediapack device management ports (typically TCP/80 or TCP/443)
• Implement intrusion detection rules to identify malformed or suspicious POST requests targeting voice gateway infrastructure
• Monitor for unexpected outbound connections from VoIP gateway devices to external IP addresses
• Establish baseline behavior profiles for Audiocodes devices and alert on deviations

Monitoring Recommendations

• Enable comprehensive logging on Audiocodes Mediapack devices and forward logs to a centralized SIEM platform
• Implement network segmentation monitoring to detect unauthorized traffic flows from voice infrastructure
• Regularly audit device configurations and compare against known-good baselines
• Monitor for firmware integrity changes using cryptographic verification where supported

How to Mitigate CVE-2025-32106

Immediate Actions Required

• Identify all Audiocodes Mediapack MP-112, MP-114, and MP-118 devices in your environment running firmware version 6.60A.369.002 or earlier
• Restrict network access to device management interfaces using firewall rules and network segmentation
• Disable web management interface access from untrusted networks immediately
• Contact Audiocodes support for guidance on patched firmware availability

Patch Information

Organizations should check the Audiocodes Official Website for the latest firmware updates addressing this vulnerability. Apply security patches as soon as they become available from the vendor. Given the critical nature of this vulnerability and the unauthenticated remote code execution capability, patching should be prioritized for all affected devices.

Workarounds

• Implement strict access control lists (ACLs) to limit management interface access to trusted administrative IP addresses only
• Place Audiocodes Mediapack devices behind a VPN or jump host to prevent direct exposure to untrusted networks
• Disable the web management interface entirely if not required for operations, using alternative management methods such as console access
• Deploy a web application firewall (WAF) in front of management interfaces to filter potentially malicious POST requests

# Example firewall rules to restrict management access (adapt to your environment)
# Block external access to Audiocodes management ports
iptables -A INPUT -p tcp --dport 80 -s ! 10.0.0.0/8 -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! 10.0.0.0/8 -j DROP

# Allow only specific administrative subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.10.10.0/24 -j ACCEPT