SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Remote Command Injection

published 2025-12-22 10 mo ago modified 2026-10-01 38 d ago also EUVD-2023-60248

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 3.4%; EPSS 3.4% chance of exploitation in 30 days, percentile 88%
public exploits: 0; none known

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands through the 'password' parameter. Attackers can exploit the login.php and index.php scripts by injecting shell commands via the 'password' POST parameter to execute commands with web server privileges.

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: total
Assessed: 10 mo ago (2025-12-22)

Exploit prediction

3.40% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

exploit-db.com https://www.exploit-db.com/exploits/51173 referenced PoC, tagged "exploit" by a source, unverified
zeroscience.mk https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5738.php referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	4.0	9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

SOUND4 Ltd. Impact/Pulse/First
SOUND4 Ltd. Impact/Pulse Eco
SOUND4 Ltd. BigVoice4
SOUND4 Ltd. BigVoice2
SOUND4 Ltd. Stream
Kantar Media WM2

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

exploit-db.com /exploits/51173
exploit, third-party-advisory, vdb-entry
zeroscience.mk /en/vulnerabilities/ZSL-2022-5738.php
third-party-advisory, exploit
web.archive.org /web/20221207074555/https://www.sound4.com/
product
vulncheck.com /advisories/sound-impactfirstpulseeco-x-unauthenticated-remote-command-injection
third-party-advisory

Sources

CVE List CVE-2023-53963
NVD CVE-2023-53963

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary