CVE-2022-50794
Unauthenticated Command Injection in SOUND4 2.x via Username Parameter
Publication date: 2025-12-30
Last updated on: 2025-12-30
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sound4 | impact | 2.* |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below, where an unauthenticated attacker can perform command injection via the 'username' parameter in the index.php and login.php scripts. By sending specially crafted HTTP POST requests, the attacker can inject arbitrary shell commands that the system executes.
How can this vulnerability impact me? :
The vulnerability allows remote attackers to execute arbitrary system commands without authentication, potentially leading to full system compromise, data theft, service disruption, or further attacks on the affected system.