CVE-2022-50793
Published: 30 December 2025
Description
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an authenticated command injection vulnerability in the www-data-handler.php script that allows attackers to inject system commands through the 'services' POST parameter. Attackers can exploit this vulnerability by crafting malicious 'services' parameter values to execute arbitrary system…
more
commands with www-data user privileges.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the command injection by requiring validation and sanitization of the 'services' POST parameter in www-data-handler.php to block malicious inputs.
Remediates the specific flaw in the vulnerable PHP script through timely identification, reporting, and patching of the CVE.
Limits damage from injected commands by enforcing least privilege on the www-data user executing the arbitrary system commands.
Security SummaryAI
CVE-2022-50793 is an authenticated command injection vulnerability (CWE-78) in SOUND4 IMPACT, FIRST, PULSE, and Eco devices running versions <=2.x. The issue exists in the www-data-handler.php script, which processes the 'services' POST parameter without proper sanitization, enabling attackers to inject and execute arbitrary system commands with www-data user privileges.
Exploitation requires low-privileged authenticated access (PR:L) over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), as reflected in its CVSS v3.1 base score of 8.8 (High). Successful attacks allow remote command execution in a single-instance context (S:U), resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H).
Advisories from VulnCheck, Zero Science Lab, IBM X-Force Exchange, and Packet Storm Security detail the vulnerability, including proof-of-concept exploits, while the vendor site at sound4.com is referenced for potential updates or patches. Practitioners should consult these sources for mitigation guidance.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an authenticated command injection in a PHP script allowing arbitrary system command execution as www-data (Unix/Linux environment), directly enabling T1059.004: Unix Shell.