CVE-2022-50796

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Remote Code Execution via upload.cgi

State: Published
Severity: 9.3 Critical
Published: Dec 30, 2025
Updated: Oct 1, 2026
Reserved: Dec 26, 2025

Description

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an unauthenticated remote code execution vulnerability in the firmware upload functionality with path traversal flaw. Attackers can exploit the upload.cgi script to write malicious files to the system with www-data permissions, enabling unauthorized access and code execution.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
Impact/Pulse/FirstSOUND4 Ltd.	Version 2: 1.1/2.15Affected
Impact/Pulse EcoSOUND4 Ltd.	1.16Affected
BigVoice4SOUND4 Ltd.	1.2Affected
BigVoice2SOUND4 Ltd.	1.30Affected
StreamSOUND4 Ltd.	1.1/2.4.29Affected
WM2Kantar Media	1.11Affected

References

Zero Science Lab Disclosure (ZSL-2022-5741)third-party-advisory
Packet Storm Security Exploit Detailsexploit
IBM X-Force Vulnerability Exchange Entryvdb-entry
SOUND4 Product Homepageproduct
VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Remote Code Execution via upload.cgithird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.