CVE-2023-53965

SOUND4 Server Service 4.1.102 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted binary path by inserting malicious code in the system root path that could execute with LocalSystem privileges during service startup.

CVSS 4.0

8.6CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-28)

CWE

CWE-428

Published

2025-12-22

Modified

2026-10-28

Record from

the NVD, synced 2026-10-28

Affected

• sound4:big_voice_firmware
• sound4:first_firmware
• sound4:impact_eco_firmware
• sound4:impact_firmware
• sound4:ip_connect_firmware
• sound4:playout_ula8_firmware
• sound4:pulse_eco_firmware
• sound4:pulse_firmware
• sound4:stream_x2_firmware
• sound4:stream_x4_firmware
• sound4:stream_x8_firmware
• sound4:voice_ula2_firmware
• sound4:voice_ula4_firmware
• sound4:voice_ula8_firmware
• sound4:wm2_firmware

References

• https://web.archive.org/web/20221207074555/https://www.sound4.com/
• https://www.exploit-db.com/exploits/51167
• https://www.vulncheck.com/advisories/sound-server-service-local-privilege-escalation-via-unquoted-service-path
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5721.php
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5721.php

Check your stackJSON