CVE-2022-50695

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x ICMP Flood Attack via Network Commands

State: Published
Severity: 8.7 High
Published: Dec 30, 2025
Updated: Oct 1, 2026
Reserved: Dec 21, 2025

Description

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x contains a network vulnerability that allows unauthenticated attackers to send ICMP signals to arbitrary hosts through network command scripts. Attackers can abuse ping.php, traceroute.php, and dns.php to generate network flooding attacks targeting external hosts.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	VulnCheck

Weaknesses

CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
Impact/Pulse/FirstSOUND4 Ltd.	Version 2: 1.1/2.15Affected
Impact/Pulse EcoSOUND4 Ltd.	1.16Affected
BigVoice4SOUND4 Ltd.	1.2Affected
BigVoice2SOUND4 Ltd.	1.30Affected
StreamSOUND4 Ltd.	1.1/2.4.29Affected
WM2Kantar Media	1.11Affected

References

Zero Science Lab Disclosure (ZSL-2022-5728)third-party-advisory
Packet Storm Security Exploit Detailsexploit
IBM X-Force Vulnerability Exchangevdb-entry
SOUND4 Product Homepageproduct
VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x ICMP Flood Attack via Network Commandsthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.