CVSS 4.0
6.9 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NCVE-2022-50692
Medium (6.9) in sound4. EPSS 0.6% chance of exploitation in the next 30 days.
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an insufficient session expiration vulnerability that allows attackers to reuse old session credentials. Attackers can exploit weak session management to potentially hijack active user sessions and gain unauthorized access to the application.
Severity
CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
- CWE
- CWE-613
- Published
- Modified
- Record from
- the NVD, synced
Affected
- sound4:big_voice2_firmware
- sound4:big_voice4_firmware
- sound4:first_firmware
- sound4:impact_eco_firmware
- sound4:impact_firmware
- sound4:pulse_eco_firmware
- sound4:pulse_firmware
- sound4:stream_extension
- sound4:wm2_firmware
References
- https://cxsecurity.com/issue/WLB-2022120030
- https://exchange.xforce.ibmcloud.com/vulnerabilities/247956
- https://packetstormsecurity.com/files/170251/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Insufficient-Session-Expiration.html
- https://www.sound4.com/
- https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-insufficient-session-expiration-vulnerability