Cyber Posture

CVE-2022-50794

CriticalPublic PoC

Published: 30 December 2025

Published
30 December 2025
Modified
13 January 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0173 82.6th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Description

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploit index.php and login.php scripts by injecting arbitrary shell commands through the HTTP POST 'username' parameter to execute system commands.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly prevents command injection by validating and sanitizing the unauthenticated HTTP POST username parameter in index.php and login.php.

prevent

Requires timely identification, reporting, and remediation of the specific command injection flaw in SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below.

preventdetect

Boundary protection with web application firewalls or proxies inspects and blocks malicious username payloads targeting the vulnerable login scripts.

Security SummaryAI

CVE-2022-50794 is an unauthenticated command injection vulnerability (CWE-78) in SOUND4 IMPACT, FIRST, PULSE, and Eco versions 2.x and below. The issue affects the index.php and login.php scripts, where attackers can inject arbitrary shell commands through the HTTP POST username parameter to execute system commands on the server.

Any unauthenticated attacker with network access can exploit this vulnerability due to its low attack complexity and lack of required privileges or user interaction, as indicated by its CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation allows remote code execution, potentially granting full control over the affected system with high impacts to confidentiality, integrity, and availability.

Advisories detailing the vulnerability, including potential mitigations, are available from sources such as IBM X-Force Exchange (https://exchange.xforce.ibmcloud.com/vulnerabilities/247914), Packet Storm Security (https://packetstormsecurity.com/files/170266/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-username-Command-Injection.html), VulnCheck (https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-command-injection-via-username), and Zero Science Labs (https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5739.php), as well as the vendor site (https://www.sound4.com/).

Details

CWE(s)

Affected Products

sound4
impact firmware
1.69, 2.15
sound4
pulse firmware
1.69, 2.15
sound4
first firmware
1.69, 2.15
sound4
impact eco firmware
1.16
sound4
pulse eco firmware
1.16
sound4
big voice4 firmware
1.2
sound4
big voice2 firmware
1.30
sound4
wm2 firmware
1.11
sound4
stream extension
2.4.29

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

Unauthenticated command injection in public-facing web scripts (index.php, login.php) enables exploitation of public-facing application (T1190) and arbitrary Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References