CVE-2023-53955

CRITICAL

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Auth Bypass

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-53955. PoCs published by LiquidWorm.

AI-analyzed exploit summary This is a vulnerability writeup detailing an Insecure Direct Object Reference (IDOR) flaw in SOUND4 IMPACT/FIRST/PULSE/Eco v2.x, allowing unauthorized access to system resources. The document lists affected versions, vulnerable endpoints, and file paths but does not include executable exploit code.

Description

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows attackers to bypass authorization and access hidden system resources. Attackers can exploit the vulnerability by manipulating user-supplied input to execute privileged functionalities without proper authentication.

Exploits (1)

exploitdb WRITEUP

by LiquidWorm · textlocalwindows

https://www.exploit-db.com/exploits/51169

View Code ZIP pw:eip

This is a vulnerability writeup detailing an Insecure Direct Object Reference (IDOR) flaw in SOUND4 IMPACT/FIRST/PULSE/Eco v2.x, allowing unauthorized access to system resources. The document lists affected versions, vulnerable endpoints, and file paths but does not include executable exploit code.

Classification

Writeup 90%

Attack Type

Auth Bypass

Complexity

Trivial

Reliability

Theoretical

Target: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x (various versions)

No auth needed

Prerequisites: Network access to the target system · Knowledge of vulnerable endpoints

MITRE ATT&CK

T1222 - File and Directory Permissions Modification T1087 - Account Discovery

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4

Core References

Exploit, Third Party Advisory, VDB Entry exploit

https://www.exploit-db.com/exploits/51169

Product product

https://web.archive.org/web/20221207074555/https://www.sound4.com/

Exploit, Third Party Advisory third-party-advisory

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5723.php

Third Party Advisory third-party-advisory

https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-authorization-bypass-via-insecure-object-references

Scores

CVSS v3 9.8

EPSS 0.0076

EPSS Percentile 50.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-639

Status published

Products (12)

sound4/big_voice2_firmware 1.30

sound4/big_voice4_firmware 1.2

sound4/first_firmware 2.15

sound4/first_firmware 1.69

sound4/impact_eco_firmware 1.16

sound4/impact_firmware 2.15

sound4/impact_firmware 1.69

sound4/pulse_eco_firmware 1.16

sound4/pulse_firmware 2.15

sound4/pulse_firmware 1.69

... and 2 more

Published Dec 22, 2025

Tracked Since Feb 18, 2026