ICMP Injection Vulnerability in SOUND4 Network Scripts Enables Flooding

Publication date: 2025-12-30

Last updated on: 2025-12-30

Assigner: VulnCheck

Description

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x contains a network vulnerability that allows unauthenticated attackers to send ICMP signals to arbitrary hosts through network command scripts. Attackers can abuse ping.php, traceroute.php, and dns.php to generate network flooding attacks targeting external hosts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-30

Last Modified

2025-12-30

Generated

2026-07-06

AI Q&A

2025-12-31

EPSS Evaluated

2026-07-05

NVD

CVE-2022-50695

Affected Vendors & Products

Vendor	Product	Version / Range
sound4	impact	2.x

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability exists in SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and allows unauthenticated attackers to send ICMP signals to arbitrary hosts by abusing network command scripts such as ping.php, traceroute.php, and dns.php. This can be exploited to generate network flooding attacks targeting external hosts.

Impact Analysis

The vulnerability can be exploited to perform network flooding attacks on external hosts, potentially causing denial of service or disruption of network availability for those targets.

Hi! I’m here to help you understand CVE-2022-50695. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70