CVE-2023-22957

An issue was discovered in libac_des3.so on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of hard-coded cryptographic key, an attacker with access to backup or configuration files is able to decrypt encrypted values and retrieve sensitive information, e.g., the device root password.

• CWE-798

• https://packetstormsecurity.com/files/174215/AudioCodes-VoIP-Phones-Hardcoded-Key.htmlExploit, Third Party Advisory, VDB Entry
• https://seclists.org/fulldisclosure/2023/Aug/15Exploit, Mailing List, Third Party Advisory
• https://syss.deNot Applicable
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-052.txtExploit, Vendor Advisory
• https://packetstormsecurity.com/files/174215/AudioCodes-VoIP-Phones-Hardcoded-Key.htmlExploit, Third Party Advisory, VDB Entry
• https://seclists.org/fulldisclosure/2023/Aug/15Exploit, Mailing List, Third Party Advisory
• https://syss.deNot Applicable
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-052.txtExploit, Vendor Advisory

Published

Aug 11, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22950An issue was discovered in TigerGraph Enterprise Free Editio…6.5
• CVE-2023-22951An issue was discovered in TigerGraph Enterprise Free Editio…8.8
• CVE-2023-22952In SugarCRM before 12.0. Hotfix 91155, a crafted request can…8.8
• CVE-2023-22953In ExpressionEngine before 7.2.6, remote code execution can …8.8
• CVE-2023-22955An issue was discovered on AudioCodes VoIP desk phones throu…7.8
• CVE-2023-22956An issue was discovered on AudioCodes VoIP desk phones throu…7.5
• CVE-2023-22958The Syracom Secure Login plugin before 3.1.1.0 for Jira may …6.1
• CVE-2023-22959WebChess through 0.9.0 and 1.0.0.rc2 allows SQL injection: m…8.8
• CVE-2023-2296The Loginizer WordPress plugin before 1.7.9 does not escape …6.1
• CVE-2023-22960Lexmark products through 2023-01-10 have Improper Control of…7.5
• CVE-2023-22963The personnummer implementation before 3.0.3 for Dart mishan…5.3
• CVE-2023-22964Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x…9.1