Vulnerability Details CVE-2022-50696
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified through normal device operations. Attackers can leverage these static credentials to gain unauthorized access to the device across Linux and Windows distributions without requiring user interaction.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 10.2%
CVSS Severity
CVSS v3 Score 6.5
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/247949
- https://packetstormsecurity.com/files/170256/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Hardcoded-Credentials.html
- https://www.sound4.com/
- https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-hardcoded-credentials-authentication-bypass
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5729.php
Products affected by CVE-2022-50696
-
cpe:2.3:a:sound4:stream_extension:2.4.29
-
cpe:2.3:h:sound4:big_voice2:-
-
cpe:2.3:h:sound4:big_voice4:-
-
cpe:2.3:h:sound4:first:1.0
-
cpe:2.3:h:sound4:first:2.0
-
cpe:2.3:h:sound4:impact:1.0
-
cpe:2.3:h:sound4:impact:2.0
-
cpe:2.3:h:sound4:impact_eco:-
-
cpe:2.3:h:sound4:pulse:1.0
-
cpe:2.3:h:sound4:pulse:2.0
-
cpe:2.3:h:sound4:pulse_eco:-
-
cpe:2.3:h:sound4:wm2:-
-
cpe:2.3:o:sound4:big_voice2_firmware:1.30
-
cpe:2.3:o:sound4:big_voice4_firmware:1.2
-
cpe:2.3:o:sound4:first_firmware:1.69
-
cpe:2.3:o:sound4:first_firmware:2.15
-
cpe:2.3:o:sound4:impact_eco_firmware:1.16
-
cpe:2.3:o:sound4:impact_firmware:1.69
-
cpe:2.3:o:sound4:impact_firmware:2.15
-
cpe:2.3:o:sound4:pulse_eco_firmware:1.16
-
cpe:2.3:o:sound4:pulse_firmware:1.69
-
cpe:2.3:o:sound4:pulse_firmware:2.15
-
cpe:2.3:o:sound4:wm2_firmware:1.11