← Back

CVE-2023-53963

nvd nist
Published: Dec 22, 2025Modified: Jun 17, 2026

JSON object

Loading...
9.3
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: disclosure@vulncheck.com (Secondary)

Description

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands through the 'password' parameter. Attackers can exploit the login.php and index.php scripts by injecting shell commands via the 'password' POST parameter to execute commands with web server privileges.

Affected (12)

Sound4
9 products
Impact Firmware
Pulse Firmware
First Firmware
Impact Eco Firmware
Pulse Eco Firmware
Big Voice4 Firmware
Big Voice2 Firmware
Wm2 Firmware
Stream Extension
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Impact Firmware
Version 2.15
Running on/withPlatform Versions
Sound4
Impact
Version 2.0
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Impact Firmware
Version 1.69
Running on/withPlatform Versions
Sound4
Impact
Version 1.0
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Pulse Firmware
Version 2.15
Running on/withPlatform Versions
Sound4
Pulse
Version 2.0
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Pulse Firmware
Version 1.69
Running on/withPlatform Versions
Sound4
Pulse
Version 1.0
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
First Firmware
Version 2.15
Running on/withPlatform Versions
Sound4
First
Version 2.0
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
First Firmware
Version 1.69
Running on/withPlatform Versions
Sound4
First
Version 1.0
Configuration G
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Impact Eco Firmware
Version 1.16
Running on/withPlatform Versions
Sound4
Impact Eco
All versions
Configuration H
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Pulse Eco Firmware
Version 1.16
Running on/withPlatform Versions
Sound4
Pulse Eco
All versions
Configuration I
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Big Voice4 Firmware
Version 1.2
Running on/withPlatform Versions
Sound4
Big Voice4
All versions
Configuration J
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Big Voice2 Firmware
Version 1.30
Running on/withPlatform Versions
Sound4
Big Voice2
All versions
Configuration K
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Wm2 Firmware
Version 1.11
Running on/withPlatform Versions
Sound4
Wm2
All versions
Configuration L
1 vulnerable
Vulnerable SoftwareAffected Versions
Stream Extension
Version 2.4.29

Related CWEs

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (5)

Source: disclosure@vulncheck.com
Product
Source: disclosure@vulncheck.com
ExploitThird Party AdvisoryVDB Entry
Source: disclosure@vulncheck.com
Third Party Advisory
Source: disclosure@vulncheck.com
ExploitThird Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ExploitThird Party Advisory

Timeline

No history available yet.