CVE-2023-53965

SOUND4 Server Service 4.1.102 Local Privilege Escalation via Unquoted Service Path

Published Dec 22, 2025 CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Description
SOUND4 Server Service 4.1.102 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted binary path by inserting malicious code in the system root path that could execute with LocalSystem privileges during service startup.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Sound4 big Voice
Sound4 big Voice Firmware
Sound4 first
Sound4 first Firmware
Sound4 impact
Sound4 impact Eco
Sound4 impact Eco Firmware
Sound4 impact Firmware
Sound4 ip Connect
Sound4 ip Connect Firmware
Sound4 playout Ula8
Sound4 playout Ula8 Firmware
Sound4 pulse
Sound4 pulse Eco
Sound4 pulse Eco Firmware
Sound4 pulse Firmware
Sound4 stream X2
Sound4 stream X2 Firmware
Sound4 stream X4
Sound4 stream X4 Firmware
Sound4 stream X8
Sound4 stream X8 Firmware
Sound4 voice Ula2
Sound4 voice Ula2 Firmware
Sound4 voice Ula4
Sound4 voice Ula4 Firmware
Sound4 voice Ula8
Sound4 voice Ula8 Firmware
Sound4 wm2
Sound4 wm2 Firmware
CPEs cpe:2.3:h:sound4:big_voice:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:first:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact_eco:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:ip_connect:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:playout_ula8:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse_eco:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:stream_x2:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:stream_x4:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:stream_x8:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:voice_ula2:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:voice_ula4:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:voice_ula8:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:wm2:-:*:*:*:*:*:*:*
cpe:2.3:o:sound4:big_voice_firmware:4.1.102:*:*:*:*:*:*:*
cpe:2.3:o:sound4:first_firmware:4.1.102:*:*:*:*:*:*:*
cpe:2.3:o:sound4:impact_eco_firmware:4.1.102:*:*:*:*:*:*:*
cpe:2.3:o:sound4:impact_firmware:4.1.102:*:*:*:*:*:*:*
cpe:2.3:o:sound4:ip_connect_firmware:4.1.102:*:*:*:*:*:*:*
cpe:2.3:o:sound4:playout_ula8_firmware:4.1.102:*:*:*:*:*:*:*
cpe:2.3:o:sound4:pulse_eco_firmware:4.1.102:*:*:*:*:*:*:*
cpe:2.3:o:sound4:pulse_firmware:4.1.102:*:*:*:*:*:*:*
cpe:2.3:o:sound4:stream_x2_firmware:4.1.102:*:*:*:*:*:*:*
cpe:2.3:o:sound4:stream_x4_firmware:4.1.102:*:*:*:*:*:*:*
cpe:2.3:o:sound4:stream_x8_firmware:4.1.102:*:*:*:*:*:*:*
cpe:2.3:o:sound4:voice_ula2_firmware:4.1.102:*:*:*:*:*:*:*
cpe:2.3:o:sound4:voice_ula4_firmware:4.1.102:*:*:*:*:*:*:*
cpe:2.3:o:sound4:voice_ula8_firmware:4.1.102:*:*:*:*:*:*:*
cpe:2.3:o:sound4:wm2_firmware:4.1.102:*:*:*:*:*:*:*
Vendors & Products Sound4 big Voice
Sound4 big Voice Firmware
Sound4 first
Sound4 first Firmware
Sound4 impact
Sound4 impact Eco
Sound4 impact Eco Firmware
Sound4 impact Firmware
Sound4 ip Connect
Sound4 ip Connect Firmware
Sound4 playout Ula8
Sound4 playout Ula8 Firmware
Sound4 pulse
Sound4 pulse Eco
Sound4 pulse Eco Firmware
Sound4 pulse Firmware
Sound4 stream X2
Sound4 stream X2 Firmware
Sound4 stream X4
Sound4 stream X4 Firmware
Sound4 stream X8
Sound4 stream X8 Firmware
Sound4 voice Ula2
Sound4 voice Ula2 Firmware
Sound4 voice Ula4
Sound4 voice Ula4 Firmware
Sound4 voice Ula8
Sound4 voice Ula8 Firmware
Sound4 wm2
Sound4 wm2 Firmware
Type Values Removed Values Added
First Time appeared Sound4
Sound4 server Service
Vendors & Products Sound4
Sound4 server Service
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description SOUND4 Server Service 4.1.102 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted binary path by inserting malicious code in the system root path that could execute with LocalSystem privileges during service startup.
Title SOUND4 Server Service 4.1.102 Local Privilege Escalation via Unquoted Service Path
Weaknesses CWE-428
References
Metrics cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}