CVE-2022-50794

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-50794", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2025-12-26T16:41:38.890Z", "datePublished": "2025-12-30T22:41:38.681Z", "dateUpdated": "2026-10-01T19:19:11.695Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-01T19:19:11.695Z"}, "datePublic": "2022-12-14T00:00:00.000Z", "title": "SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via Username", "descriptions": [{"lang": "en", "value": "SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploit index.php and login.php scripts by injecting arbitrary shell commands through the HTTP POST 'username' parameter to execute system commands."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "cweId": "CWE-78", "type": "CWE"}]}], "affected": [{"vendor": "SOUND4 Ltd.", "product": "Impact/Pulse/First", "versions": [{"version": "Version 2: 1.1/2.15", "status": "affected"}]}, {"vendor": "SOUND4 Ltd.", "product": "Impact/Pulse Eco", "versions": [{"version": "1.16", "status": "affected"}]}, {"vendor": "SOUND4 Ltd.", "product": "BigVoice4", "versions": [{"version": "1.2", "status": "affected"}]}, {"vendor": "SOUND4 Ltd.", "product": "BigVoice2", "versions": [{"version": "1.30", "status": "affected"}]}, {"vendor": "SOUND4 Ltd.", "product": "Stream", "versions": [{"version": "1.1/2.4.29", "status": "affected"}]}, {"vendor": "Kantar Media", "product": "WM2", "versions": [{"version": "1.11", "status": "affected"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:h:sound4:impact:1.1:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:h:sound4:impact:2.15:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:h:sound4:pulse:1.1:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:h:sound4:pulse:2.15:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:h:sound4:first:1.1:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:h:sound4:first:2.15:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:h:sound4:impact:1.16:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:h:sound4:pulse_eco:1.16:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:h:sound4:big_voice4:1.2:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:h:sound4:big_voice2:1.30:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:sound4:stream_extension:1.1:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:sound4:stream_extension:2.4.29:*:*:*:*:*:*:*"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5739.php", "name": "Zero Science Lab Disclosure (ZSL-2022-5739)", "tags": ["third-party-advisory"]}, {"url": "https://packetstormsecurity.com/files/170266/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-username-Command-Injection.html", "name": "Packet Storm Security Exploit Details", "tags": ["exploit"]}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/247914", "name": "IBM X-Force Vulnerability Exchange Entry", "tags": ["vdb-entry"]}, {"url": "https://www.sound4.com/", "name": "SOUND4 Product Homepage", "tags": ["product"]}, {"name": "VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via Username", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-command-injection-via-username"}], "credits": [{"lang": "en", "value": "LiquidWorm as Gjoko Krstic of Zero Science Lab", "type": "finder"}], "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-05T20:18:46.413679Z", "id": "CVE-2022-50794", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-05T20:19:28.739Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-50794", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-05T20:18:46.413679Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-05T20:19:04.003Z"}}], "cna": {"title": "SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via Username", "credits": [{"lang": "en", "type": "finder", "value": "LiquidWorm as Gjoko Krstic of Zero Science Lab"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "SOUND4 Ltd.", "product": "Impact/Pulse/First", "versions": [{"status": "affected", "version": "Version 2: 1.1/2.15"}]}, {"vendor": "SOUND4 Ltd.", "product": "Impact/Pulse Eco", "versions": [{"status": "affected", "version": "1.16"}]}, {"vendor": "SOUND4 Ltd.", "product": "BigVoice4", "versions": [{"status": "affected", "version": "1.2"}]}, {"vendor": "SOUND4 Ltd.", "product": "BigVoice2", "versions": [{"status": "affected", "version": "1.30"}]}, {"vendor": "SOUND4 Ltd.", "product": "Stream", "versions": [{"status": "affected", "version": "1.1/2.4.29"}]}, {"vendor": "Kantar Media", "product": "WM2", "versions": [{"status": "affected", "version": "1.11"}]}], "datePublic": "2022-12-14T00:00:00.000Z", "references": [{"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5739.php", "name": "Zero Science Lab Disclosure (ZSL-2022-5739)", "tags": ["third-party-advisory"]}, {"url": "https://packetstormsecurity.com/files/170266/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-username-Command-Injection.html", "name": "Packet Storm Security Exploit Details", "tags": ["exploit"]}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/247914", "name": "IBM X-Force Vulnerability Exchange Entry", "tags": ["vdb-entry"]}, {"url": "https://www.sound4.com/", "name": "SOUND4 Product Homepage", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-command-injection-via-username", "name": "VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via Username", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploit index.php and login.php scripts by injecting arbitrary shell commands through the HTTP POST 'username' parameter to execute system commands."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sound4:impact:1.1:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:h:sound4:impact:2.15:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:h:sound4:pulse:1.1:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:h:sound4:pulse:2.15:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:h:sound4:first:1.1:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:h:sound4:first:2.15:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:h:sound4:impact:1.16:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:h:sound4:pulse_eco:1.16:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:h:sound4:big_voice4:1.2:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:h:sound4:big_voice2:1.30:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:sound4:stream_extension:1.1:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:sound4:stream_extension:2.4.29:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-01T19:19:11.695Z"}}}, "cveMetadata": {"cveId": "CVE-2022-50794", "state": "PUBLISHED", "dateUpdated": "2026-10-01T19:19:11.695Z", "dateReserved": "2025-12-26T16:41:38.890Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2025-12-30T22:41:38.681Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Impact/Pulse/First", "vendor": "SOUND4 Ltd.", "versions": [{"status": "affected", "version": "Version 2: 1.1/2.15"}]}, {"product": "Impact/Pulse Eco", "vendor": "SOUND4 Ltd.", "versions": [{"status": "affected", "version": "1.16"}]}, {"product": "BigVoice4", "vendor": "SOUND4 Ltd.", "versions": [{"status": "affected", "version": "1.2"}]}, {"product": "BigVoice2", "vendor": "SOUND4 Ltd.", "versions": [{"status": "affected", "version": "1.30"}]}, {"product": "Stream", "vendor": "SOUND4 Ltd.", "versions": [{"status": "affected", "version": "1.1/2.4.29"}]}, {"product": "WM2", "vendor": "Kantar Media", "versions": [{"status": "affected", "version": "1.11"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sound4:impact_firmware:2.15:*:*:*:*:*:*:*", "matchCriteriaId": "33C347FE-DA7B-4137-87B8-E6A8AF4D307F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sound4:impact:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "0A735654-A166-4B56-BF4D-F165B7E11043", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sound4:impact_firmware:1.69:*:*:*:*:*:*:*", "matchCriteriaId": "5C4CF02A-8CF1-46FF-9EC0-FF779D60B6EA", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sound4:impact:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "EC9BD81B-573A-4DA7-AC47-6C8AF1B6B18F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sound4:pulse_firmware:2.15:*:*:*:*:*:*:*", "matchCriteriaId": "18E34118-F11B-4BF2-BE23-7DAE0A6790FB", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sound4:pulse:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "C46BF88C-955C-4F9E-B782-1EADA068F19D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sound4:pulse_firmware:1.69:*:*:*:*:*:*:*", "matchCriteriaId": "E0699DEA-9CDA-4BB4-8FA3-6A6FADE1A61E", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sound4:pulse:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "051868AE-E364-4CB3-B927-42B4E0C19D01", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sound4:first_firmware:2.15:*:*:*:*:*:*:*", "matchCriteriaId": "FBDECDEC-C5A2-4B0D-B3E0-58CCCC804BCF", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sound4:first:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "4EF10967-A7DC-4DF0-94BE-935FFC1888D6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sound4:first_firmware:1.69:*:*:*:*:*:*:*", "matchCriteriaId": "713CC97E-CC0A-41B8-B8CA-EAD8F774F77C", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sound4:first:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "C4034A51-85E1-44E7-973B-7BFFFB083832", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sound4:impact_eco_firmware:1.16:*:*:*:*:*:*:*", "matchCriteriaId": "5ED99BE5-4598-4D5C-B0F0-3BE6E5B05C10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sound4:impact_eco:-:*:*:*:*:*:*:*", "matchCriteriaId": "B4B0A611-C50E-4397-ACDF-8D090D4AFC88", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sound4:pulse_eco_firmware:1.16:*:*:*:*:*:*:*", "matchCriteriaId": "9A3C132F-ACCE-4618-8EC2-31624571F0BF", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sound4:pulse_eco:-:*:*:*:*:*:*:*", "matchCriteriaId": "71E155FD-162E-4EA9-9BD9-89384B3AD175", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sound4:big_voice4_firmware:1.2:*:*:*:*:*:*:*", "matchCriteriaId": "DFF4C955-E4AF-4A3A-89F9-481CE5DB7BF1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sound4:big_voice4:-:*:*:*:*:*:*:*", "matchCriteriaId": "404A1397-CD88-4CB5-99B9-B84F3359E13F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sound4:big_voice2_firmware:1.30:*:*:*:*:*:*:*", "matchCriteriaId": "45230C2E-D043-45F5-869F-FEB0A3AEB5DE", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sound4:big_voice2:-:*:*:*:*:*:*:*", "matchCriteriaId": "8C68C1DC-EC1C-445B-B78C-6E4B64BB5DB0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sound4:wm2_firmware:1.11:*:*:*:*:*:*:*", "matchCriteriaId": "05D5318D-BD08-4D8E-9D94-4D0FD0C0023E", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sound4:wm2:-:*:*:*:*:*:*:*", "matchCriteriaId": "ED8E14DD-2C04-4080-AAE9-6D770436AC6C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sound4:stream_extension:2.4.29:*:*:*:*:*:*:*", "matchCriteriaId": "DFFD1447-69A1-4FA0-B285-6F16D9113558", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploit index.php and login.php scripts by injecting arbitrary shell commands through the HTTP POST 'username' parameter to execute system commands."}, {"lang": "es", "value": "Las versiones 2.x e inferiores de SOUND4 IMPACT/FIRST/PULSE/Eco contienen una vulnerabilidad de inyecci\u00f3n de comandos no autenticada en el par\u00e1metro 'username'. Los atacantes pueden explotar los scripts index.PHP y login.PHP inyectando comandos de shell arbitrarios a trav\u00e9s del par\u00e1metro HTTP POST 'username' para ejecutar comandos del sistema."}], "id": "CVE-2022-50794", "lastModified": "2026-06-17T05:24:11.820", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-50794", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-05T20:18:46.413679Z", "version": "2.0.3"}}]}, "published": "2025-12-30T23:15:46.410", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/247914"}, {"source": "disclosure@vulncheck.com", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://packetstormsecurity.com/files/170266/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-username-Command-Injection.html"}, {"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://www.sound4.com/"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-command-injection-via-username"}, {"source": "disclosure@vulncheck.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5739.php"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"created": "2026-01-05T10:19:36.960658+00:00", "updated": "2026-01-05T10:19:36.960684+00:00", "vendors": ["sound4", "sound4$PRODUCT$bigvoice2", "sound4$PRODUCT$bigvoice4", "sound4$PRODUCT$first", "sound4$PRODUCT$impact", "sound4$PRODUCT$pulse-eco", "sound4$PRODUCT$stream"]}