CVE-2023-22955 is a firmware-integrity vulnerability (CWE-345, insufficient verification of data authenticity) in AudioCodes 400HD series VoIP desk phones: the on-device 'flasher' tool that validates and installs firmware updates checks only simple additive checksums for each firmware section rather than a cryptographic signature, so an attacker who knows how to calculate and place the correct checksums can build a malicious firmware image — for example one with an added root-privileged user account — and have the phone install it as if it were genuine; NVD has published its own Primary CVSS v3.1 score of 7.8 (high) for the flaw.
Vulnerability summary
7.8
High
0.3%
EPSS score (FIRST)
No
CISA KEV catalog
2023-08-11
Published
Vulnerability ID: CVE-2023-22955 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| AudioCodes 400HD series VoIP desk phones (405HD, 445HD and C450HD confirmed in NVD's CPE configuration data) | — | Firmware through 3.4.4.1000, per NVD's description; SySS GmbH's advisory lists the issue as affecting firmware versions >= 3.4.4.1000 (tested on 3.4.4.1000) and records Solution Status as 'Open' with Solution Date 'N.A.' as of public disclosure on 2023-08-10 |
What does this mean for affected devices?
CVE-2023-22955 (CWE-345, insufficient verification of data authenticity) affects AudioCodes' 400HD series of VoIP desk phones. NVD's description states: "An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. The validation of firmware images only consists of simple checksum checks for different firmware components. Thus, by knowing how to calculate and where to store the required checksums for the flasher tool, an attacker is able to store malicious firmware" (NVD).
The vulnerability was discovered and disclosed by SySS GmbH researchers Matthias Deeg and Moritz Abrell. Their advisory SYSS-2022-055 describes AudioCodes 400HD phones as "modern desk phones which are used for the operation in enterprise environments" and explains the root cause in detail: firmware images are parsed and verified by an ELF executable called "flasher," and "the validation of firmware images only consists of simple checksum checks for different firmware components" — each image section is preceded by magic bytes and a header containing a checksum computed by simply adding up all the bytes in that section's data (SySS Advisory SYSS-2022-055).
As proof of concept, SySS built a modified firmware image for an AudioCodes C450HD phone that added an extra user account with root privileges inside the image's "rootfs.ext4" section, recalculated that section's checksum with a custom Python tool, and successfully uploaded and installed the tampered image on the phone (SySS Advisory SYSS-2022-055).
NVD lists its own Primary CVSS v3.1 base score of 7.8 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD). NVD's CPE configuration data for this CVE names three affected models by firmware: the 405HD, 445HD and C450HD, each vulnerable through firmware build 3.4.4.1000 (NVD).
SySS's advisory timeline shows the issue was reported to AudioCodes on 2022-11-14 and publicly disclosed on 2023-08-10, with Solution Status recorded as "Open" and Solution Date "N.A." at the time of disclosure — SySS's advisory does not record a vendor-confirmed fixed firmware version, so phone operators should check directly with AudioCodes for the current patch status of their specific model and firmware branch rather than assume a fix has shipped (SySS Advisory SYSS-2022-055).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00309 (23.915th percentile) as of 2026-11-07 — exploitation requires local/physical access to the device's update mechanism (NVD's vector marks attack vector as Local), which limits its remote blast radius compared to network-reachable flaws (CISA KEV, FIRST EPSS).
Organizations deploying AudioCodes 405HD, 445HD or C450HD phones should confirm with AudioCodes whether a firmware release with cryptographic firmware-image signing has since shipped for their branch, and in the meantime restrict who can reach each phone's firmware-update interface.
Evidence
- AudioCodes VoIP desk phones through 3.4.4.1000 validate firmware images only with simple checksum checks for different firmware components; an attacker who can calculate and place the required checksums can store malicious firmware (CWE-345). — NVD
- The 'flasher' ELF tool parses and verifies firmware images using only additive checksums per section rather than cryptographic signatures; each section is preceded by magic bytes and a header containing the checksum. — SySS Advisory SYSS-2022-055
- Proof of concept: a modified firmware image for the AudioCodes C450HD with an added root-privileged user account in the rootfs.ext4 section, with its checksum recalculated, was successfully uploaded and installed on the phone. — SySS Advisory SYSS-2022-055
- NVD Primary CVSS v3.1 base score 7.8 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; CPE data names the 405HD, 445HD and C450HD as affected through firmware 3.4.4.1000. — NVD
- Reported to AudioCodes 2022-11-14, publicly disclosed 2023-08-10; Solution Status 'Open', Solution Date 'N.A.' at time of disclosure. — SySS Advisory SYSS-2022-055
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00309 (23.915th percentile) as of 2026-11-07. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What is actually wrong with how AudioCodes 400HD phones validate firmware updates?
The on-device 'flasher' tool checks only a simple additive checksum for each firmware section instead of verifying a cryptographic signature, so anyone who knows the checksum algorithm can modify a firmware image — for example by adding a new privileged user account — recompute the checksum, and have the phone install it as if it were legitimate (per SySS Advisory SYSS-2022-055; per NVD).
Which AudioCodes phone models does CVE-2023-22955 affect?
NVD's CPE configuration data names the 405HD, 445HD and C450HD models, each vulnerable in firmware builds through 3.4.4.1000 (per NVD).
Has AudioCodes released a fixed firmware version for this issue?
As of SySS's public disclosure on 2023-08-10, the advisory recorded Solution Status as 'Open' with Solution Date 'N.A.' — no vendor-confirmed fixed version is documented in that advisory, so affected-device operators should check directly with AudioCodes for the current status on their firmware branch (per SySS Advisory SYSS-2022-055).