CVE-2022-50794
CRITICALSOUND4 IMPACT/FIRST/PULSE/Eco <2 - Command Injection
Title source: llmDescription
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploit index.php and login.php scripts by injecting arbitrary shell commands through the HTTP POST 'username' parameter to execute system commands.
References (5)
Core 5
Core References
Exploit, Third Party Advisory third-party-advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5739.php
Exploit, Third Party Advisory, VDB Entry exploit
https://packetstormsecurity.com/files/170266/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-username-Command-Injection.html
Third Party Advisory vdb-entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/247914
Product product
https://www.sound4.com/
Third Party Advisory third-party-advisory
https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-command-injection-via-username
Scores
CVSS v3
9.8
EPSS
0.0326
EPSS Percentile
86.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-78
Status
published
Products (12)
sound4/big_voice2_firmware
1.30
sound4/big_voice4_firmware
1.2
sound4/first_firmware
2.15
sound4/first_firmware
1.69
sound4/impact_eco_firmware
1.16
sound4/impact_firmware
2.15
sound4/impact_firmware
1.69
sound4/pulse_eco_firmware
1.16
sound4/pulse_firmware
2.15
sound4/pulse_firmware
1.69
... and 2 more
Published
Dec 30, 2025
Tracked Since
Feb 18, 2026