CVE-2022-50794
Published: 30 December 2025
Description
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploit index.php and login.php scripts by injecting arbitrary shell commands through the HTTP POST 'username' parameter to execute system commands.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by validating and sanitizing the unauthenticated HTTP POST username parameter in index.php and login.php.
Requires timely identification, reporting, and remediation of the specific command injection flaw in SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below.
Boundary protection with web application firewalls or proxies inspects and blocks malicious username payloads targeting the vulnerable login scripts.
Security SummaryAI
CVE-2022-50794 is an unauthenticated command injection vulnerability (CWE-78) in SOUND4 IMPACT, FIRST, PULSE, and Eco versions 2.x and below. The issue affects the index.php and login.php scripts, where attackers can inject arbitrary shell commands through the HTTP POST username parameter to execute system commands on the server.
Any unauthenticated attacker with network access can exploit this vulnerability due to its low attack complexity and lack of required privileges or user interaction, as indicated by its CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation allows remote code execution, potentially granting full control over the affected system with high impacts to confidentiality, integrity, and availability.
Advisories detailing the vulnerability, including potential mitigations, are available from sources such as IBM X-Force Exchange (https://exchange.xforce.ibmcloud.com/vulnerabilities/247914), Packet Storm Security (https://packetstormsecurity.com/files/170266/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-username-Command-Injection.html), VulnCheck (https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-command-injection-via-username), and Zero Science Labs (https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5739.php), as well as the vendor site (https://www.sound4.com/).
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated command injection in public-facing web scripts (index.php, login.php) enables exploitation of public-facing application (T1190) and arbitrary Unix shell command execution (T1059.004).