CVE-2022-50692
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Insufficient Session Expiration Vulnerability
- State
- Published
- Severity
- 6.9 Medium
- Published
- Dec 30, 2025
- Updated
- Oct 1, 2026
- Reserved
- Dec 21, 2025
Description
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an insufficient session expiration vulnerability that allows attackers to reuse old session credentials. Attackers can exploit weak session management to potentially hijack active user sessions and gain unauthorized access to the application.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-613 Insufficient Session Expiration
Affected Products
| Product | Versions |
|---|---|
Impact/Pulse/FirstSOUND4 Ltd. |
|
Impact/Pulse EcoSOUND4 Ltd. |
|
BigVoice4SOUND4 Ltd. |
|
BigVoice2SOUND4 Ltd. |
|
StreamSOUND4 Ltd. |
|
WM2Kantar Media |
|
References
- Zero Science Lab Disclosure (ZSL-2022-5724)third-party-advisory
- Packet Storm Security Exploit Entryexploit
- CXSecurity Vulnerability Listingthird-party-advisory
- IBM X-Force Vulnerability Exchangevdb-entry
- SOUND4 Product Homepageproduct
- VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Insufficient Session Expiration Vulnerabilitythird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.