CVE-2023-53963

9.3 criticalEPSS 3.4%

Critical (9.3) in sound4. EPSS 3.4% chance of exploitation in the next 30 days.

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands through the 'password' parameter. Attackers can exploit the login.php and index.php scripts by injecting shell commands via the 'password' POST parameter to execute commands with web server privileges.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.4% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2025-12-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sound4:big_voice2_firmware
sound4:big_voice4_firmware
sound4:first_firmware
sound4:impact_eco_firmware
sound4:impact_firmware
sound4:pulse_eco_firmware
sound4:pulse_firmware
sound4:stream_extension
sound4:wm2_firmware

References

Check your stack JSON