SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploit index.php and login.php scripts by injecting arbitrary shell commands through the HTTP POST 'username' parameter to execute system commands.
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSound4 Big Voice2
HWSound4wszystkie wersjeSound4 Big Voice2 Firmware
OSSound41.30Sound4 Big Voice4
HWSound4wszystkie wersjeSound4 Big Voice4 Firmware
OSSound41.2Sound4 First
HWSound41.02.0Sound4 First Firmware
OSSound41.692.15Sound4 Impact
HWSound41.02.0Sound4 Impact Eco
HWSound4wszystkie wersjeSound4 Impact Eco Firmware
OSSound41.16Sound4 Impact Firmware
OSSound41.692.15Sound4 Pulse
HWSound41.02.0Sound4 Pulse Eco
HWSound4wszystkie wersjeSound4 Pulse Eco Firmware
OSSound41.16Sound4 Pulse Firmware
OSSound41.692.15Sound4 Stream Extension
APPSound42.4.29Sound4 Wm2
HWSound4wszystkie wersjeSound4 Wm2 Firmware
OSSound41.11
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
Related vulnerabilities
CVE-2022-50796CRITICAL9.3PL ✓ten sam produkt
RCE i path traversal w firmware upload SOUND4 IMPACT/FIRST/PULSE/Eco
CVE-2022-50696CRITICAL9.3PL ✓ten sam produkt
Zakodowane na stałe dane logowania w urządzeniach SOUND4 IMPACT/FIRST/PULSE/Eco
CVE-2023-53960CRITICAL9.3PL ✓ten sam produkt
SQL Injection w mechanizmie logowania SOUND4 IMPACT/FIRST/PULSE/Eco
CVE-2023-53955CRITICAL9.3PL ✓ten sam produkt
IDOR w SOUND4 IMPACT/FIRST/PULSE/Eco v2.x — pominięcie autoryzacji
CVE-2023-53963CRITICAL9.3PL ✓ten sam produkt
Nieuwierzytelniony OS command injection w SOUND4 IMPACT/FIRST/PULSE/Eco v2.x