CVE-2023-22955

An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. The validation of firmware images only consists of simple checksum checks for different firmware components. Thus, by knowing how to calculate and where to store the required checksums for the flasher tool, an attacker is able to store malicious firmware.

• CWE-345

• http://packetstormsecurity.com/files/174214/AudioCodes-VoIP-Phones-Insufficient-Firmware-Validation.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2023/Aug/17Mailing List, Third Party Advisory
• https://syss.deNot Applicable
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-055.txtExploit, Vendor Advisory
• http://packetstormsecurity.com/files/174214/AudioCodes-VoIP-Phones-Insufficient-Firmware-Validation.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2023/Aug/17Mailing List, Third Party Advisory
• https://syss.deNot Applicable
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-055.txtExploit, Vendor Advisory

Published

Aug 11, 2023

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22949An issue was discovered in TigerGraph Enterprise Free Editio…4.9
• CVE-2023-2295A vulnerability was found in the libreswan library. This sec…7.5
• CVE-2023-22950An issue was discovered in TigerGraph Enterprise Free Editio…6.5
• CVE-2023-22951An issue was discovered in TigerGraph Enterprise Free Editio…8.8
• CVE-2023-22952In SugarCRM before 12.0. Hotfix 91155, a crafted request can…8.8
• CVE-2023-22953In ExpressionEngine before 7.2.6, remote code execution can …8.8
• CVE-2023-22956An issue was discovered on AudioCodes VoIP desk phones throu…7.5
• CVE-2023-22957An issue was discovered in libac_des3.so on AudioCodes VoIP …7.5
• CVE-2023-22958The Syracom Secure Login plugin before 3.1.1.0 for Jira may …6.1
• CVE-2023-22959WebChess through 0.9.0 and 1.0.0.rc2 allows SQL injection: m…8.8
• CVE-2023-2296The Loginizer WordPress plugin before 1.7.9 does not escape …6.1
• CVE-2023-22960Lexmark products through 2023-01-10 have Improper Control of…7.5