CVSS 4.0
8.8 highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:NCVE-2023-53962
High (8.8) in sound4. EPSS 1.2% chance of exploitation in the next 30 days.
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated directory traversal vulnerability that allows remote attackers to write arbitrary files through the 'upgfile' parameter in upload.cgi. Attackers can exploit the vulnerability by sending crafted multipart form-data POST requests with directory traversal sequences to write files to unintended system locations.
Severity
CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- sound4:big_voice2_firmware
- sound4:big_voice4_firmware
- sound4:first_firmware
- sound4:impact_eco_firmware
- sound4:impact_firmware
- sound4:pulse_eco_firmware
- sound4:pulse_firmware
- sound4:stream_extension
- sound4:wm2_firmware
References
- https://web.archive.org/web/20221207074555/https://www.sound4.com/
- https://www.exploit-db.com/exploits/51172
- https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-directory-traversal-file-write
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5730.php
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5730.php