CVE-2022-50795

Published: Dec 30, 2025Modified: Jun 17, 2026

8.5

Vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory. Unauthenticated attackers can execute commands by making a single HTTP POST request to the traceroute.php script, which triggers the malicious file and then deletes it after execution.

Affected (12)

Products: Sound4: Impact Firmware, Pulse Firmware, First Firmware, Impact Eco Firmware, Pulse Eco Firmware, Big Voice4 Firmware, Big Voice2 Firmware, Stream Extension, Wm2 Firmware

9 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sound4 Impact Firmware	Version 2.15

Running on/with	Platform Versions
Sound4 Impact	Version 2.0

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sound4 Impact Firmware	Version 1.69

Running on/with	Platform Versions
Sound4 Impact	Version 1.0

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sound4 Pulse Firmware	Version 2.15

Running on/with	Platform Versions
Sound4 Pulse	Version 2.0

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sound4 Pulse Firmware	Version 1.69

Running on/with	Platform Versions
Sound4 Pulse	Version 1.0

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sound4 First Firmware	Version 2.15

Running on/with	Platform Versions
Sound4 First	Version 2.0

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sound4 First Firmware	Version 1.69

Running on/with	Platform Versions
Sound4 First	Version 1.0

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sound4 Impact Eco Firmware	Version 1.16

Running on/with	Platform Versions
Sound4 Impact Eco	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sound4 Pulse Eco Firmware	Version 1.16

Running on/with	Platform Versions
Sound4 Pulse Eco	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sound4 Big Voice4 Firmware	Version 1.2

Running on/with	Platform Versions
Sound4 Big Voice4	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sound4 Big Voice2 Firmware	Version 1.30

Running on/with	Platform Versions
Sound4 Big Voice2	All versions

Configuration K

1 vulnerable

Vulnerable Software	Affected Versions
Sound4 Stream Extension	Version 2.4.29

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sound4 Wm2 Firmware	Version 1.11

Running on/with	Platform Versions
Sound4 Wm2	All versions

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.