CVE-2022-50790

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Radio Stream Disclosure

State: Published
Severity: 6.9 Medium
Published: Dec 30, 2025
Updated: Oct 1, 2026
Reserved: Dec 26, 2025

Description

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated vulnerability that allows remote attackers to access live radio stream information through webplay or ffmpeg scripts. Attackers can exploit the vulnerability by calling specific web scripts to disclose radio stream details without requiring authentication.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	VulnCheck

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
Impact/Pulse/FirstSOUND4 Ltd.	Version 2: 1.1/2.15Affected
Impact/Pulse EcoSOUND4 Ltd.	1.16Affected
BigVoice4SOUND4 Ltd.	1.2Affected
BigVoice2SOUND4 Ltd.	1.30Affected
StreamSOUND4 Ltd.	1.1/2.4.29Affected
WM2Kantar Media	1.11Affected

References

Zero Science Lab Disclosure (ZSL-2022-5734)third-party-advisory
Packet Storm Security Exploit Detailsexploit
IBM X-Force Vulnerability Exchange Entryvdb-entry
SOUND4 Product Homepageproduct
VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Radio Stream Disclosurethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.