SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive log files. Attackers can directly browse the /log directory to retrieve system and sensitive information without authentication.
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSound4 Big Voice2
HWSound4wszystkie wersjeSound4 Big Voice2 Firmware
OSSound41.30Sound4 Big Voice4
HWSound4wszystkie wersjeSound4 Big Voice4 Firmware
OSSound41.2Sound4 First
HWSound41.02.0Sound4 First Firmware
OSSound41.692.15Sound4 Impact
HWSound41.02.0Sound4 Impact Eco
HWSound4wszystkie wersjeSound4 Impact Eco Firmware
OSSound41.16Sound4 Impact Firmware
OSSound41.692.15Sound4 Pulse
HWSound41.02.0Sound4 Pulse Eco
HWSound4wszystkie wersjeSound4 Pulse Eco Firmware
OSSound41.16Sound4 Pulse Firmware
OSSound41.692.15Sound4 Stream Extension
APPSound42.4.29Sound4 Wm2
HWSound4wszystkie wersjeSound4 Wm2 Firmware
OSSound41.11
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
Related vulnerabilities
CVE-2022-50796CRITICAL9.3PL ✓ten sam produkt
RCE i path traversal w firmware upload SOUND4 IMPACT/FIRST/PULSE/Eco
CVE-2022-50794CRITICAL9.3PL ✓ten sam produkt
Command injection w parametrze username — SOUND4 IMPACT/FIRST/PULSE/Eco
CVE-2022-50696CRITICAL9.3PL ✓ten sam produkt
Zakodowane na stałe dane logowania w urządzeniach SOUND4 IMPACT/FIRST/PULSE/Eco
CVE-2023-53955CRITICAL9.3PL ✓ten sam produkt
IDOR w SOUND4 IMPACT/FIRST/PULSE/Eco v2.x — pominięcie autoryzacji
CVE-2023-53960CRITICAL9.3PL ✓ten sam produkt
SQL Injection w mechanizmie logowania SOUND4 IMPACT/FIRST/PULSE/Eco