S
OUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an unauthenticated remote code execution vulnerability in the firmware upload functionality with path traversal flaw. Attackers can exploit the upload.cgi script to write malicious files to the system with www-data permissions, enabling unauthorized access and code execution.
References
| Link | Resource |
|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/247951 | Third Party Advisory |
| https://packetstormsecurity.com/files/170268/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-upload.cgi-Code-Execution.html | Exploit Third Party Advisory VDB Entry |
| https://www.sound4.com/ | Product |
| https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-remote-code-execution-via-uploadcgi | Third Party Advisory |
| https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5741.php | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
Configuration 5 (hide)
| AND |
|
Configuration 6 (hide)
| AND |
|
Configuration 7 (hide)
| AND |
|
Configuration 8 (hide)
| AND |
|
Configuration 9 (hide)
| AND |
|
Configuration 10 (hide)
| AND |
|
Configuration 11 (hide)
| AND |
|
Configuration 12 (hide)
|
History
16 Jan 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
13 Jan 2026, 13:37
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/247951 - Third Party Advisory | |
| References | () https://packetstormsecurity.com/files/170268/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-upload.cgi-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://www.sound4.com/ - Product | |
| References | () https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-remote-code-execution-via-uploadcgi - Third Party Advisory | |
| References | () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5741.php - Exploit, Third Party Advisory | |
| First Time |
Sound4 wm2
Sound4 big Voice4 Firmware Sound4 Sound4 pulse Eco Sound4 impact Sound4 pulse Sound4 impact Eco Sound4 big Voice2 Firmware Sound4 impact Eco Firmware Sound4 big Voice4 Sound4 stream Extension Sound4 pulse Firmware Sound4 pulse Eco Firmware Sound4 first Firmware Sound4 first Sound4 wm2 Firmware Sound4 impact Firmware Sound4 big Voice2 |
|
| CPE | cpe:2.3:h:sound4:pulse_eco:-:*:*:*:*:*:*:* cpe:2.3:o:sound4:impact_firmware:1.69:*:*:*:*:*:*:* cpe:2.3:o:sound4:big_voice4_firmware:1.2:*:*:*:*:*:*:* cpe:2.3:h:sound4:wm2:-:*:*:*:*:*:*:* cpe:2.3:h:sound4:impact_eco:-:*:*:*:*:*:*:* cpe:2.3:o:sound4:wm2_firmware:1.11:*:*:*:*:*:*:* cpe:2.3:h:sound4:pulse:1.0:*:*:*:*:*:*:* cpe:2.3:o:sound4:pulse_firmware:2.15:*:*:*:*:*:*:* cpe:2.3:h:sound4:big_voice2:-:*:*:*:*:*:*:* cpe:2.3:o:sound4:pulse_firmware:1.69:*:*:*:*:*:*:* cpe:2.3:h:sound4:big_voice4:-:*:*:*:*:*:*:* cpe:2.3:o:sound4:impact_eco_firmware:1.16:*:*:*:*:*:*:* cpe:2.3:o:sound4:impact_firmware:2.15:*:*:*:*:*:*:* cpe:2.3:o:sound4:first_firmware:2.15:*:*:*:*:*:*:* cpe:2.3:o:sound4:big_voice2_firmware:1.30:*:*:*:*:*:*:* cpe:2.3:o:sound4:first_firmware:1.69:*:*:*:*:*:*:* cpe:2.3:a:sound4:stream_extension:2.4.29:*:*:*:*:*:*:* cpe:2.3:h:sound4:pulse:2.0:*:*:*:*:*:*:* cpe:2.3:h:sound4:first:1.0:*:*:*:*:*:*:* cpe:2.3:o:sound4:pulse_eco_firmware:1.16:*:*:*:*:*:*:* cpe:2.3:h:sound4:impact:1.0:*:*:*:*:*:*:* cpe:2.3:h:sound4:first:2.0:*:*:*:*:*:*:* cpe:2.3:h:sound4:impact:2.0:*:*:*:*:*:*:* |
30 Dec 2025, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-30 23:15
Updated : 2026-01-16 19:16
NVD link : CVE-2022-50796
Mitre link : CVE-2022-50796
CVE.ORG link : CVE-2022-50796
JSON object : View
Products Affected
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')