CVE-2022-50796 - SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Remote Code Execution via upload.cgi

Back Back to CVE browser

CRITICAL

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Remote Code Execution via upload.cgi

Published Dec 30, 2025

9.3

CRITICAL

CVSS 4.0

EPSS 1.57%

Description

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an unauthenticated remote code execution vulnerability in the firmware upload functionality with path traversal flaw. Attackers can exploit the upload.cgi script to write malicious files to the system with www-data permissions, enabling unauthorized access and code execution.

Affected products

Vendor Kantar Media Product WM2 Default
n/a
- Version
  1.11
  Status
  affected
  Constraints
  -
Vendor SOUND4 Ltd. Product BigVoice2 Default
n/a
- Version
  1.30
  Status
  affected
  Constraints
  -
Vendor SOUND4 Ltd. Product BigVoice4 Default
n/a
- Version
  1.2
  Status
  affected
  Constraints
  -
Vendor SOUND4 Ltd. Product Impact/Pulse Eco Default
n/a
- Version
  1.16
  Status
  affected
  Constraints
  -
Vendor SOUND4 Ltd. Product Impact/Pulse/First Default
n/a
- Version
  Version 2: 1.1/2.15
  Status
  affected
  Constraints
  -
Vendor SOUND4 Ltd. Product Stream Default
n/a
- Version
  1.1/2.4.29
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Kantar Media

WM2

n/a

Version	Status	Constraints
1.11	affected	-

SOUND4 Ltd.

BigVoice2

n/a

Version	Status	Constraints
1.30	affected	-

SOUND4 Ltd.

BigVoice4

n/a

Version	Status	Constraints
1.2	affected	-

SOUND4 Ltd.

Impact/Pulse Eco

n/a

Version	Status	Constraints
1.16	affected	-

SOUND4 Ltd.

Impact/Pulse/First

n/a

Version	Status	Constraints
Version 2: 1.1/2.15	affected	-

SOUND4 Ltd.

Stream

n/a

Version	Status	Constraints
1.1/2.4.29	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-55930
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/247951
vdb-entryThird Party Advisory
https://packetstormsecurity.com/files/170268/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-upload.cgi-Code-Execution.html
exploitThird Party AdvisoryVDB Entry
https://www.sound4.com/
product
https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-remote-code-execution-via-uploadcgi
third-party-advisoryThird Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5741.php
third-party-advisoryExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-55930		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/247951		vdb-entryThird Party Advisory
https://packetstormsecurity.com/files/170268/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-upload.cgi-Code-Execution.html		exploitThird Party AdvisoryVDB Entry
https://www.sound4.com/		product
https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-remote-code-execution-via-uploadcgi		third-party-advisoryThird Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5741.php		third-party-advisoryExploitThird Party Advisory