CVSS 4.0
9.3 criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCVE-2022-50794
Critical (9.3) in sound4. EPSS 3.7% chance of exploitation in the next 30 days.
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploit index.php and login.php scripts by injecting arbitrary shell commands through the HTTP POST 'username' parameter to execute system commands.
Severity
CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- EPSS
- 3.7% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-31)
- CWE
- CWE-78
- Published
- Modified
- Record from
- the NVD, synced
Affected
- sound4:big_voice2_firmware
- sound4:big_voice4_firmware
- sound4:first_firmware
- sound4:impact_eco_firmware
- sound4:impact_firmware
- sound4:pulse_eco_firmware
- sound4:pulse_firmware
- sound4:stream_extension
- sound4:wm2_firmware
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/247914
- https://packetstormsecurity.com/files/170266/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-username-Command-Injection.html
- https://www.sound4.com/
- https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-command-injection-via-username
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5739.php