CVE-2023-53961

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Cross-Site Request Forgery

State: Published
Severity: 5.1 Medium
Published: Dec 22, 2025
Updated: Oct 1, 2026
Reserved: Dec 19, 2025

Description

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages that submit HTTP requests to the radio processing interface, triggering unintended administrative operations when a logged-in user visits the page.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	VulnCheck

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
Impact/Pulse/FirstSOUND4 Ltd.	Version 2: 1.1/2.15Affected
Impact/Pulse EcoSOUND4 Ltd.	1.16Affected
BigVoice4SOUND4 Ltd.	1.2Affected
BigVoice2SOUND4 Ltd.	1.30Affected
StreamSOUND4 Ltd.	1.1/2.4.29Affected
WM2Kantar Media	1.11Affected

References

ExploitDB-51168exploit
SOUND4 Official Product Homepageproduct
Zero Science Lab Disclosure (ZSL-2022-5722)third-party-advisory
VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Cross-Site Request Forgerythird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.