CVE-2022-50794

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via Username

State: Published
Severity: 9.3 Critical
Published: Dec 30, 2025
Updated: Oct 1, 2026
Reserved: Dec 26, 2025

Description

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploit index.php and login.php scripts by injecting arbitrary shell commands through the HTTP POST 'username' parameter to execute system commands.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
Impact/Pulse/FirstSOUND4 Ltd.	Version 2: 1.1/2.15Affected
Impact/Pulse EcoSOUND4 Ltd.	1.16Affected
BigVoice4SOUND4 Ltd.	1.2Affected
BigVoice2SOUND4 Ltd.	1.30Affected
StreamSOUND4 Ltd.	1.1/2.4.29Affected
WM2Kantar Media	1.11Affected

References

Zero Science Lab Disclosure (ZSL-2022-5739)third-party-advisory
Packet Storm Security Exploit Detailsexploit
IBM X-Force Vulnerability Exchange Entryvdb-entry
SOUND4 Product Homepageproduct
VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via Usernamethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.