Description Summary:
SOUND4 LinkAndShare Transmitter 1.1.2 is vulnerable to a format string flaw allowing stack buffer overflows via malicious environment variables, potentially leading to arbitrary code execution.

Executive Summary:
A critical format string vulnerability in SOUND4 LinkAndShare Transmitter 1.1.2 allows unauthenticated attackers to trigger stack buffer overflows and achieve potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2023-53966

Affected Software: SOUND4 Ltd. LinkAndShare Transmitter

Affected Versions: 1.1.2

Vulnerability: The application fails to properly sanitize user-supplied input when processing the username environment variable via the getenv() function, resulting in a format string vulnerability that leads to a stack buffer overflow. This flaw can be triggered by an unauthenticated attacker to crash the application or execute arbitrary code.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary code on systems running the LinkAndShare Transmitter poses a severe risk to organizational infrastructure. Successful exploitation could lead to full system compromise, data exfiltration, or the disruption of critical broadcast control services. Given the CVSS score of 9.8, this vulnerability represents a critical threat requiring immediate attention.

Remediation Plan

Immediate Action: As no official patch is currently available from the vendor, restrict access to the affected system to trusted users only and isolate the application from untrusted network segments.

Proactive Monitoring: Monitor system logs for unexpected application crashes or service restarts that may indicate exploitation attempts targeting the environment variables.

Compensating Controls: Deploy a host-based intrusion prevention system (HIPS) or endpoint detection and response (EDR) solution to detect and block abnormal process execution or buffer overflow patterns.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via the Exploit Database (EDB-ID 51259).

Analyst Notes: As of December 22, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of sanitization on externally controlled environment variables.

Analyst Recommendation

Due to the critical severity and the public availability of exploit code, organizations must treat this vulnerability with the highest priority. If the software is not essential, disable it immediately until a vendor-supplied patch is released and verified. If the software is required, ensure it is restricted to internal, hardened segments to minimize the potential attack surface.

Description Summary:
SOUND4 Server Service 4.1.102 is vulnerable to an unquoted service path flaw, allowing local attackers to execute arbitrary code with SYSTEM privileges.

Executive Summary:
A local privilege escalation vulnerability in SOUND4 Server Service 4.1.102 allows non-privileged users to execute code with SYSTEM-level permissions, posing a critical security risk.

Vulnerability Details

CVE-ID: CVE-2023-53965

Affected Software: SOUND4 Ltd. SOUND4 Server Service

Affected Versions: 4.1.102

Vulnerability: The application utilizes an unquoted service path, which permits a local, non-privileged user to place a malicious executable in the system root path. During service startup, the system incorrectly interprets the path and executes the attacker-supplied binary with elevated LocalSystem privileges.

Business Impact

Successful exploitation grants an attacker full control over the host system, bypassing standard user security boundaries. Given the CVSS score of 8.4, this vulnerability represents a high-severity risk that could lead to complete system compromise, the installation of persistent backdoors, or the exfiltration of sensitive data stored on the affected server.

Remediation Plan

Immediate Action: As no official patch is currently confirmed, administrators should manually modify the service path registry key to include quotes (e.g., change the path to "C:\Program Files\SOUND4\Server\SOUND4 Server.exe"). Ensure that proper folder permissions are applied to the directory to prevent unauthorized users from writing files to the path.

Proactive Monitoring: Monitor system logs for unauthorized service installations or suspicious process creation events initiated by non-privileged accounts. Review registry modifications related to service binary paths to detect unauthorized changes.

Compensating Controls: Restrict local user write access to the directory path hosting the service executable. Implement strict endpoint detection and response policies to alert on unauthorized binary execution attempting to masquerade as legitimate services.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Zero Science Lab advisory and the Exploit-DB entry.

Analyst Notes: As of December 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any local user who can write files to the system root, making it a reliable target for lateral movement or persistence.

Analyst Recommendation

The risk posed by this privilege escalation vulnerability is significant due to the potential for full system takeover. Organizations currently running SOUND4 Server Service 4.1.102 must prioritize securing the service path configuration immediately to prevent local attackers from escalating their privileges. If remediation is not possible through configuration changes, the service should be isolated or disabled until a vendor-supplied update is available.

Description Summary:
SOUND4 audio processing devices contain an unauthenticated factory reset vulnerability in the /usr/cgi-bin/restorefactory.cgi endpoint, allowing remote attackers to gain full system control.

Executive Summary:
Unauthenticated remote attackers can trigger a factory reset on various SOUND4 audio processing devices, leading to a complete loss of configuration and potential unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2023-53964

Affected Software: SOUND4 Ltd. IMPACT, FIRST, PULSE, Eco, BigVoice4, BigVoice2, Stream, and Kantar Media WM2

Affected Versions: Impact/Pulse/First (Version 2: 1.1/2.15; Version 1: 2.1/1.69), Impact/Pulse Eco 1.16, BigVoice4 1.2, BigVoice2 1.30, Stream 1.1/2.4.29, WM2 1.11

Vulnerability: The device fails to perform authentication checks on the /usr/cgi-bin/restorefactory.cgi endpoint. An unauthenticated attacker can send a crafted POST request to this endpoint to force the device to reset to factory defaults, effectively clearing existing security configurations and allowing the attacker to establish administrative control using default credentials.

Business Impact

The vulnerability poses a severe risk to broadcast infrastructure, as successful exploitation results in immediate service disruption and a total loss of device configuration. With a CVSS score of 7.5, the risk is classified as High, reflecting the potential for unauthorized actors to hijack critical audio processing hardware, potentially leading to unauthorized broadcasts or the permanent denial of service for affected radio stations.

Remediation Plan

Immediate Action: As no vendor patch is currently confirmed, administrators should immediately isolate vulnerable devices from the public internet and restrict access to the management interface to trusted internal networks only.

Proactive Monitoring: Monitor network traffic for any unexpected POST requests directed at the /usr/cgi-bin/restorefactory.cgi endpoint and audit device configuration logs for unauthorized reset events.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an access control list (ACL) to block all external access to the vulnerable CGI script until a firmware update is provided by the manufacturer.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via the Exploit Database (EDB-ID: 51174).

Analyst Notes: As of December 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is trivial to trigger, as it requires only a single HTTP POST request to an unprotected endpoint.

Analyst Recommendation

Given the ease of exploitation and the critical nature of broadcast equipment, organizations must treat this vulnerability with high urgency. Immediately restrict network access to affected devices to prevent unauthorized remote reset commands, and maintain close contact with the vendor for official firmware updates to remediate the underlying authentication failure.

Description Summary:
SOUND4 audio processing products contain an unauthenticated OS command injection vulnerability in the password parameter of login.php and index.php, allowing remote code execution as the web user.

Executive Summary:
An unauthenticated remote command injection vulnerability in multiple SOUND4 audio processing products poses a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2023-53963

Affected Software: SOUND4 Ltd. IMPACT, FIRST, PULSE, Eco, BigVoice, Stream, and WM2

Affected Versions: See metadata for specific version strings.

Vulnerability: The application fails to sanitize input in the password POST parameter within login.php and index.php, which is passed directly to an exec system call. This allows an unauthenticated attacker to inject arbitrary shell commands that execute with the privileges of the web server.

Business Impact

Successful exploitation of this vulnerability grants an attacker complete control over the affected broadcasting hardware. Given the CVSS score of 9.8, this represents a critical risk, potentially leading to unauthorized data access, service disruption, and the use of compromised broadcasting equipment as a pivot point for further attacks on the internal network.

Remediation Plan

Immediate Action: Apply all available security updates provided by SOUND4 Ltd. for the affected audio processing units. If a patch is not immediately available, restrict access to the web management interfaces to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for suspicious POST requests to login.php or index.php containing shell metacharacters or unexpected command patterns. Monitor system processes for unauthorized child processes spawned by the web server user.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect incoming POST requests and block traffic containing command injection payloads targeting the password parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in the Exploit Database (EDB-ID 51173).

Analyst Notes: As of December 22, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly trivial to exploit due to the direct concatenation of user-supplied input into an execution function.

Analyst Recommendation

Due to the critical nature of this command injection flaw and the availability of public exploit code, immediate remediation is required. Organizations using SOUND4 processing units must prioritize updating firmware or software to the latest secure version to prevent unauthorized remote access and potential takeover of critical broadcasting infrastructure.

Description Summary:
SOUND4 devices are vulnerable to an unauthenticated directory traversal flaw allowing remote attackers to write arbitrary files via the upload.cgi interface.

Executive Summary:
An unauthenticated directory traversal vulnerability in multiple SOUND4 audio processing products allows remote attackers to perform arbitrary file writes, creating a significant risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2023-53962

Affected Software: SOUND4 Ltd. IMPACT, FIRST, PULSE, Eco, BigVoice, and Stream products

Affected Versions: See metadata for specific version strings provided in the enrichment data.

Vulnerability: The application suffers from an unauthenticated directory traversal flaw in the upload.cgi script. An attacker can use crafted multipart form-data POST requests containing directory traversal sequences within the upgfile parameter to bypass file path restrictions and write arbitrary files to the underlying system.

Business Impact

The ability for an unauthenticated remote attacker to write arbitrary files to the file system represents a critical security failure. This vulnerability could lead to remote code execution, configuration tampering, or the overwriting of essential system files, resulting in total service disruption and potential unauthorized access to the broader network. Given the CVSS score of 7.5, this flaw poses a substantial risk to operational integrity and availability.

Remediation Plan

Immediate Action: Contact SOUND4 support immediately to obtain security patches for your specific device model and firmware version, as a direct public patch download link is currently unavailable.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at /cgi-bin/upload.cgi, specifically looking for entries containing directory traversal sequences such as double dots (..) or absolute path references.

Compensating Controls: Implement strict network segmentation to isolate these devices from untrusted networks and deploy a Web Application Firewall (WAF) to block incoming requests containing directory traversal patterns.

Exploitation Status

Public Exploit Available: Yes, a technical write-up and proof-of-concept exploit are available via ExploitDB (EDB-ID: 51172).

Analyst Notes: As of December 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require authentication to trigger.

Analyst Recommendation

The presence of a public proof-of-concept exploit significantly increases the risk of this vulnerability being leveraged by malicious actors. Organizations utilizing affected SOUND4 hardware must prioritize the identification of exposed devices and work directly with the vendor to secure their systems. Given the potential for arbitrary file write, immediate defensive action is required to prevent unauthorized system modification.

Description Summary:
SOUND4 audio processing devices contain an SQL injection vulnerability in the index.php login page, allowing unauthenticated attackers to bypass authentication and gain unauthorized system access.

Executive Summary:
A critical SQL injection vulnerability in multiple SOUND4 broadcasting products allows unauthenticated attackers to bypass authentication and gain unauthorized access to sensitive systems.

Vulnerability Details

CVE-ID: CVE-2023-53960

Affected Software: SOUND4 Ltd. IMPACT, FIRST, PULSE, Eco, BigVoice, Stream, and WM2

Affected Versions: See metadata for full list of affected firmware and software versions.

Vulnerability: The application is susceptible to CWE-89 (SQL Injection) via the password POST parameter in the index.php authentication script. This flaw allows an unauthenticated remote attacker to manipulate SQL queries to bypass authentication mechanisms entirely.

Business Impact

Successful exploitation of this vulnerability grants unauthorized access to broadcast processing hardware, which could lead to critical service disruption, manipulation of audio streams, or the theft of sensitive configuration data. Given the CVSS score of 8.2, this represents a high-severity risk that could cause significant operational and reputational damage to broadcasting infrastructure.

Remediation Plan

Immediate Action: Contact the vendor or authorized distributor immediately to determine if a firmware patch is available for your specific hardware model, as there is no publicly confirmed patch version. If no update is available, restrict network access to these devices so they are not reachable from the public internet.

Proactive Monitoring: Review access logs for the index.php endpoint for suspicious POST requests containing SQL syntax or unusual character strings. Monitor for unexpected administrative login events originating from untrusted IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block SQL injection patterns targeting the index.php login page. Ensure that these devices are placed on an isolated management network behind a firewall.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via the Exploit-DB entry (EDB-ID 51171).

Analyst Notes: As of December 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of requirement for authentication or user interaction.

Analyst Recommendation

The presence of a publicly available proof-of-concept, combined with the ability for an unauthenticated attacker to gain administrative access, necessitates immediate action. Administrators must isolate these devices from the internet immediately to prevent unauthorized access while awaiting formal patches from the vendor.

Description Summary:
SOUND4 audio processing products are vulnerable to an insecure direct object reference (IDOR) flaw, allowing unauthenticated attackers to bypass authorization and access sensitive system resources.

Executive Summary:
A critical insecure direct object reference vulnerability in multiple SOUND4 audio processing products allows unauthenticated attackers to bypass authorization and execute privileged functions.

Vulnerability Details

CVE-ID: CVE-2023-53955

Affected Software: SOUND4 Ltd. IMPACT, FIRST, PULSE, Eco, BigVoice, Stream, and WM2

Affected Versions: Impact/Pulse/First 2.1.1/2.15, 1.2.1/1.69; Impact/Pulse Eco 1.16; BigVoice4 1.2; BigVoice2 1.30; Stream 1.1/2.4.29; WM2 1.11

Vulnerability: The application utilizes insecure direct object references (CWE-639), which occur when the software provides direct access to objects based on unauthenticated, user-supplied input. This flaw allows an attacker to manipulate parameters to gain unauthorized access to hidden resources and perform administrative actions.

Business Impact

The ability for an unauthenticated attacker to execute privileged functionality poses a severe risk to organizational operations. Successful exploitation could lead to unauthorized system configuration changes, the compromise of broadcast audio streams, or total loss of control over the affected hardware, justifying the CVSS score of 9.8.

Remediation Plan

Immediate Action: Identify all instances of affected SOUND4 equipment within the network and apply the latest vendor-provided firmware or software patches immediately.

Proactive Monitoring: Review access logs for unusual patterns, such as direct requests to administrative scripts or unauthorized attempts to access files typically restricted to authenticated users.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect incoming traffic and block requests targeting sensitive configuration or administrative endpoints.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as detailed in the Exploit-DB entry 51169.

Analyst Notes: As of December 22, 2025, there is no confirmed active exploitation in the wild, however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of authentication requirements for the vulnerable endpoints.

Analyst Recommendation

Given the critical severity of this vulnerability and the availability of public exploit material, immediate remediation is required. Security teams should prioritize patching all SOUND4 devices and ensure they are not exposed to the public internet to prevent unauthorized access.

Description Summary:
An unauthenticated remote code execution vulnerability exists in the firmware upload functionality of various SOUND4 products due to a path traversal flaw in the upload.cgi script.

Executive Summary:
SOUND4 and associated broadcast audio products are vulnerable to unauthenticated remote code execution, posing a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2022-50796

Affected Software: SOUND4 Ltd. Impact, FIRST, PULSE, Eco, BigVoice4, BigVoice2, Stream, and Kantar Media WM2

Affected Versions: See metadata for specific version strings.

Vulnerability: The vulnerability stems from an improper path traversal flaw within the upload.cgi script, which allows unauthenticated remote attackers to upload and execute malicious files on the underlying system with www-data permissions.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary code on these broadcast devices presents a severe risk to operational continuity. Successful exploitation could lead to total unauthorized control over the audio processing environment, potentially resulting in unauthorized broadcast manipulation or complete system takeover. With a CVSS score of 7.5, this high-severity flaw necessitates immediate attention to prevent malicious actors from gaining a foothold in the infrastructure.

Remediation Plan

Immediate Action: Identify all instances of the affected SOUND4 firmware and update them to the latest vendor-supplied versions immediately.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed toward the upload.cgi endpoint and review system logs for unauthorized file creation or execution attempts.

Compensating Controls: Implement strict firewall rules to restrict access to the device management interface to trusted administrative IP addresses only, effectively blocking unauthenticated external access.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the Packet Storm Security reference.

Analyst Notes: As of January 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the combination of unauthenticated access and the ability to write files to the filesystem.

Analyst Recommendation

The presence of a public proof-of-concept and the lack of authentication required for exploitation make this vulnerability an urgent priority. Organizations deploying these audio processing units should verify their firmware versions immediately and apply available updates. If an update cannot be performed, restrict network access to the device interfaces to prevent remote exploitation.

Description Summary:
SOUND4 devices contain a conditional command injection vulnerability in the traceroute.php script, allowing unauthenticated attackers to execute arbitrary system commands via HTTP POST requests.

Executive Summary:
A high-severity command injection vulnerability in multiple SOUND4 audio processing products allows unauthenticated remote attackers to execute arbitrary code on affected systems.

Vulnerability Details

CVE-ID: CVE-2022-50795

Affected Software: SOUND4 Ltd. IMPACT/FIRST/PULSE/Eco and related hardware products

Affected Versions: SOUND4 Ltd. Impact/Pulse/First: 1.1/2.15; Impact/Pulse Eco: 1.16; BigVoice4: 1.2; BigVoice2: 1.30; Stream: 1.1/2.4.29; Kantar Media WM2: 1.11

Vulnerability: The flaw is an OS Command Injection (CWE-78) located in the traceroute.php script. While the record notes that local authenticated users can create malicious files, it explicitly confirms that unauthenticated attackers can trigger command execution through a single crafted HTTP POST request.

Business Impact

Successful exploitation of this vulnerability results in full system compromise, as it allows for arbitrary command execution with the privileges of the web server. Given the CVSS score of 8.4, this poses a significant risk to data integrity, system availability, and the confidentiality of sensitive audio processing configurations. An attacker could leverage this access to pivot within the network or disrupt critical broadcast infrastructure.

Remediation Plan

Immediate Action: Update all affected SOUND4 and Kantar Media devices to the latest firmware versions provided by the vendor, ensuring that the vulnerable traceroute.php script is patched or removed.

Proactive Monitoring: Monitor network traffic for unusual HTTP POST requests directed toward the traceroute.php endpoint and review system logs for signs of unauthorized file creation within the /tmp directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block malicious POST requests containing shell metacharacters or suspicious patterns targeting the traceroute functionality.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the Packet Storm Security advisory.

Analyst Notes: As of January 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of authentication required to reach the vulnerable script.

Analyst Recommendation

This vulnerability represents a critical security risk due to the ease of exploitation and the potential for full system takeover. Organizations utilizing the affected audio processing hardware must prioritize firmware updates immediately to eliminate the command injection vector. If patching is not immediately feasible, restrict network access to the management interface to prevent unauthorized external access to the vulnerable endpoint.

Description Summary:
SOUND4 products contain an unauthenticated command injection vulnerability in the username parameter, allowing attackers to execute arbitrary system commands via crafted HTTP POST requests.

Executive Summary:
A critical unauthenticated command injection vulnerability in multiple SOUND4 products allows remote attackers to execute arbitrary system commands with elevated privileges.

Vulnerability Details

CVE-ID: CVE-2022-50794

Affected Software: SOUND4 Ltd. IMPACT, FIRST, PULSE, Eco, BigVoice, and Stream

Affected Versions: Impact/Pulse/First v2 (1.1/2.15), Impact/Pulse Eco 1.16, BigVoice4 1.2, BigVoice2 1.30, Stream 1.1/2.4.29, and Kantar Media WM2 1.11.

Vulnerability: The application fails to sanitize input within the username parameter of the index.php and login.php scripts, leading to OS Command Injection (CWE-78). This vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the affected appliance, potentially leading to total system compromise, unauthorized data exfiltration, and disruption of critical audio processing services. With a CVSS score of 9.8, this flaw represents a critical risk that could be leveraged to establish a persistent foothold within the internal network.

Remediation Plan

Immediate Action: Contact the vendor or authorized support channels immediately to obtain necessary security patches or configuration guidance, as a public fix is currently not confirmed.

Proactive Monitoring: Inspect web server access logs for anomalous POST requests to index.php or login.php containing shell metacharacters or suspicious system commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules to drop HTTP POST requests that contain suspicious patterns in the username parameter.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the technical write-up on Packet Storm Security.

Analyst Notes: As of December 30, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the ease of reaching the vulnerable endpoint without authentication.

Analyst Recommendation

Given the critical severity of this command injection vulnerability and the availability of public proof-of-concept material, organizations running affected SOUND4 appliances must prioritize mitigation. If a vendor patch is unavailable, restrict network access to these devices to trusted management segments only and implement robust WAF filtering to prevent exploitation until permanent remediation is applied.

Description Summary:
SOUND4 audio processing devices contain an authenticated OS command injection vulnerability in the www-data-handler.php script, allowing remote code execution via the services POST parameter.

Executive Summary:
An authenticated command injection vulnerability in multiple SOUND4 products allows a remote attacker to execute arbitrary system commands with elevated privileges.

Vulnerability Details

CVE-ID: CVE-2022-50793

Affected Software: SOUND4 Ltd. IMPACT, FIRST, PULSE, Eco, and related audio processing hardware

Affected Versions: Impact/Pulse/First: 2: 1.1/2.15; Impact/Pulse Eco: 1.16; BigVoice4: 1.2; BigVoice2: 1.30; Stream: 1.1/2.4.29; WM2: 1.11

Vulnerability: This is an OS command injection flaw (CWE-78) triggered via the services POST parameter in the www-data-handler.php script. The vulnerability requires the attacker to have authenticated access to the system to inject malicious payloads that execute with www-data user privileges.

Business Impact

The ability to execute arbitrary OS commands on audio processing hardware poses a severe risk to operational integrity. A successful exploit could lead to full system compromise, unauthorized data access, or the disruption of critical broadcast and streaming services. With a CVSS score of 8.8, this vulnerability is considered High severity, necessitating immediate attention to prevent unauthorized control over infrastructure.

Remediation Plan

Immediate Action: Since a specific patch is not explicitly identified, administrators must contact SOUND4 support immediately to obtain firmware updates that address the www-data-handler.php vulnerability.

Proactive Monitoring: Monitor system logs for unusual POST requests directed at www-data-handler.php and audit the creation of unexpected files or outbound network connections from the device.

Compensating Controls: Implement strict access control lists to limit who can authenticate to the device, and deploy a Web Application Firewall (WAF) to inspect and block malicious payloads within the services POST parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the Packet Storm Security reference.

Analyst Notes: As of January 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable for any authenticated user, as the command injection point lacks sufficient input neutralization.

Analyst Recommendation

Given the high CVSS score and the existence of a public proof-of-concept, this vulnerability represents a significant risk to affected SOUND4 environments. Administrators should prioritize restricting administrative access to these devices immediately while coordinating with the vendor to apply the necessary security patches.

Description Summary:
SOUND4 devices contain an unauthenticated path traversal vulnerability allowing remote attackers to access sensitive system files via the file GET parameter.

Executive Summary:
A critical unauthenticated file disclosure vulnerability in multiple SOUND4 products poses a severe risk of sensitive data exposure to remote attackers.

Vulnerability Details

CVE-ID: CVE-2022-50792

Affected Software: SOUND4 Ltd. (IMPACT, FIRST, PULSE, Eco, BigVoice4, BigVoice2, Stream) and Kantar Media (WM2)

Affected Versions: SOUND4 Impact/Pulse/First (1.1/2.15), Impact/Pulse Eco (1.16), BigVoice4 (1.2), BigVoice2 (1.30), Stream (1.1/2.4.29), and Kantar Media WM2 (1.11)

Vulnerability: The flaw is a path traversal vulnerability (CWE-22) triggered by the improper sanitization of the file parameter in GET requests. An unauthenticated remote attacker can exploit this to read arbitrary files from the underlying operating system.

Business Impact

The CVSS score of 9.8 reflects the extreme severity of this vulnerability, as it allows full unauthorized access to sensitive system files without requiring any user interaction or authentication. Successful exploitation could lead to the exposure of configuration files, credentials, or proprietary data, resulting in significant operational disruption, loss of confidentiality, and potential compromise of the entire device or connected network segments.

Remediation Plan

Immediate Action: Contact the vendor or authorized support channels immediately to obtain available firmware updates for the affected devices, as a specific public patch version is currently not documented in the provided data.

Proactive Monitoring: Review web server and system access logs for suspicious GET requests containing directory traversal sequences, such as "../", directed at the file parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) to block requests containing path traversal patterns targeting the vulnerable file parameter.

Exploitation Status

Public Exploit Available: Yes, a technical write-up and proof-of-concept details are available via Packet Storm Security.

Analyst Notes: As of March 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit because it requires no authentication or specialized knowledge to trigger the traversal mechanism.

Analyst Recommendation

Given the critical CVSS score and the existence of public proof-of-concept material, this vulnerability presents an immediate risk to any exposed SOUND4 or Kantar Media hardware. Administrators must prioritize isolating these devices from public-facing networks until verified firmware updates can be applied to remediate the path traversal flaw.

Description Summary:
SOUND4 devices are vulnerable to OS command injection via the ping.php script, allowing attackers to execute arbitrary commands through a crafted HTTP POST request.

Executive Summary:
Multiple SOUND4 broadcast processing products are susceptible to a critical command injection vulnerability that permits unauthenticated remote code execution.

Vulnerability Details

CVE-ID: CVE-2022-50791

Affected Software: SOUND4 Ltd. IMPACT, FIRST, PULSE, Eco, BigVoice4, BigVoice2, Stream, and Kantar Media WM2

Affected Versions: See individual version listings in the metadata above.

Vulnerability: This vulnerability is an OS command injection flaw located in the ping.php script. While the record notes that local authenticated users can create malicious files, it explicitly states that unauthenticated attackers can trigger command execution by sending a single crafted HTTP POST request to the target script.

Business Impact

Successful exploitation of this vulnerability allows an attacker to gain full control over the affected broadcast processing hardware. Given the 8.4 CVSS score, this represents a high risk of total system compromise, potentially leading to unauthorized manipulation of audio streams, disruption of broadcast services, and unauthorized access to sensitive network environments.

Remediation Plan

Immediate Action: Contact the vendor, SOUND4 Ltd., to obtain the latest firmware or software patches, as no public patch version was provided in the source documentation. If a patch is unavailable, isolate the affected devices from external networks and restrict access to the web interface to authorized management subnets only.

Proactive Monitoring: Monitor network traffic for unusual HTTP POST requests directed at the /ping.php endpoint. Review system logs for unexpected file creation activities within the /tmp directory or signs of shell command execution.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and block malicious HTTP POST requests containing command injection payloads targeting the ping.php script. Implement strict network segmentation to ensure these devices are not reachable from untrusted network segments.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced Packet Storm Security advisory.

Analyst Notes: As of January 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of authentication required to reach the vulnerable ping.php endpoint.

Analyst Recommendation

The presence of a published proof-of-concept combined with the ability for unauthenticated remote command execution makes this a high-priority risk. Administrators must prioritize the containment of these devices and coordinate with the vendor immediately to identify and apply the necessary security updates to prevent potential exploitation.

Description Summary:
SOUND4 radio processing products contain an unauthenticated vulnerability allowing remote attackers to disclose sensitive radio stream information via direct web script requests.

Executive Summary:
An unauthenticated information disclosure vulnerability in multiple SOUND4 products allows remote attackers to access sensitive radio stream data without authorization.

Vulnerability Details

CVE-ID: CVE-2022-50790

Affected Software: SOUND4 Ltd. IMPACT, FIRST, PULSE, Eco, and related broadcasting hardware/software.

Affected Versions: See the metadata block for specific affected versions across the SOUND4 product line and Kantar Media WM2.

Vulnerability: The flaw, categorized as CWE-306, involves missing authentication for critical functions. Attackers can reach specific web scripts, such as webplay or ffmpeg-related utilities, to extract stream details without any login requirement.

Business Impact

Successful exploitation allows unauthorized third parties to gain insight into sensitive radio stream configurations and metadata. This exposure can lead to operational intelligence gathering by adversaries, potentially facilitating further targeted attacks against broadcasting infrastructure. While the CVSS score of 9.8 reflects the ease of exploitation, the actual impact is limited to information disclosure rather than direct system compromise.

Remediation Plan

Immediate Action: Contact the vendor or authorized support channels immediately to obtain the latest firmware or software updates, as a public patch version is not explicitly documented in the provided data.

Proactive Monitoring: Review web server access logs for anomalous GET or POST requests directed at "webplay" or "ffmpeg" scripts originating from untrusted or external IP addresses.

Compensating Controls: Implement strict network segmentation and place the affected devices behind a Web Application Firewall (WAF) or VPN to ensure that management interfaces are not accessible from the public internet.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as referenced in the Packet Storm Security write-up.

Analyst Notes: As of March 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the complete lack of authentication checks on sensitive endpoints.

Analyst Recommendation

Given the high CVSS score and the existence of a public proof-of-concept, this vulnerability poses a significant risk to broadcast integrity. Administrators must prioritize restricting network access to the management interfaces of these devices immediately. Until a vendor-supplied update is verified and applied, rely on network-level access controls to negate the risk of remote unauthenticated access.

Description Summary:
A command injection vulnerability in SOUND4 products allows unauthenticated attackers to execute arbitrary system commands via a crafted HTTP POST request to the dns.php script.

Executive Summary:
A critical command injection vulnerability in various SOUND4 Ltd. products allows unauthenticated remote code execution, posing a severe risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2022-50789

Affected Software: SOUND4 Ltd. IMPACT/FIRST/PULSE/Eco (and related products)

Affected Versions: See Metadata for specific affected product versions.

Vulnerability: The application is susceptible to OS Command Injection via the dns.php script, which fails to properly sanitize input. Although the vulnerability allows authenticated users to create malicious files, unauthenticated attackers can leverage this mechanism through a single HTTP POST request to trigger code execution.

Business Impact

Successful exploitation grants an attacker the ability to execute arbitrary commands on the underlying host operating system. This level of access typically results in a total compromise of the affected appliance, potentially leading to unauthorized data exfiltration, lateral movement within the network, or permanent denial of service. The high CVSS score of 8.4 reflects the significant potential for impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Contact the vendor immediately to obtain firmware or software patches, as no public fix is currently identified. If an update is unavailable, restrict network access to the management interface of the affected devices.

Proactive Monitoring: Monitor server access logs for unusual HTTP POST requests directed at the dns.php file. Review system logs for unexpected file creation activities in the /tmp directory, specifically targeting files with the .dns.pid extension.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize POST requests containing suspicious shell metacharacters sent to the dns.php endpoint. Ensure the device is isolated behind a firewall to prevent direct exposure to untrusted networks.

Exploitation Status

Public Exploit Available: Yes, a published PoC exists, attributed to the technical documentation provided in the Packet Storm Security reference.

Analyst Notes: As of January 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of requirement for complex authentication to trigger the injection vector.

Analyst Recommendation

Given the availability of public proof-of-concept code and the high severity of command injection, this vulnerability represents a significant threat. Administrators must prioritize the isolation of affected devices from the public internet and coordinate with SOUND4 Ltd. support to verify if a patch or mitigation is available for their specific deployment. Failure to secure these endpoints could lead to a complete system compromise.

Description Summary:
SOUND4 products contain an information disclosure vulnerability allowing unauthenticated attackers to access sensitive log files via directory browsing.

Executive Summary:
An unauthenticated information disclosure vulnerability in multiple SOUND4 products allows remote attackers to access sensitive system logs, posing a significant risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2022-50788

Affected Software: SOUND4 Ltd. IMPACT/FIRST/PULSE/Eco and related products

Affected Versions: Impact/Pulse/First: 1.1, 2.15; Impact/Pulse Eco: 1.16; BigVoice4: 1.2; BigVoice2: 1.30; Stream: 1.1, 2.4.29; Kantar Media WM2: 1.11

Vulnerability: This vulnerability is a directory listing flaw (CWE-548) that allows an unauthenticated, remote attacker to browse the /log directory. By accessing this endpoint, an attacker can retrieve sensitive system information without requiring any prior authentication or authorization.

Business Impact

The exposure of system logs can lead to the leakage of sensitive configuration data, credentials, or operational details that facilitate further attacks. While the CVSS score of 7.5 indicates a high severity, the potential for an attacker to gain deep insight into the internal environment significantly increases the risk of a broader security compromise. Unauthorized access to these files may also result in regulatory non-compliance regarding data protection.

Remediation Plan

Immediate Action: Contact the vendor immediately to obtain the appropriate security patches or firmware updates for your specific device model. If a patch is unavailable, restrict network access to the management interface of these devices to trusted management subnets only.

Proactive Monitoring: Monitor web access logs for unauthorized attempts to access directories or files within the /log path. Unusual spikes in traffic or requests for log files should be investigated as potential reconnaissance attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) or an access control list (ACL) to block public access to the /log directory. Ensure that the device management interface is not exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Packet Storm Security reference.

Analyst Notes: As of January 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is trivial to exploit via standard web browsers or automated tools.

Analyst Recommendation

Given the ease with which sensitive information can be extracted, organizations using the affected SOUND4 products must treat this as a high-priority issue. Restricting network access to these systems is the most effective immediate mitigation while awaiting formal vendor patches. Administrators should prioritize the isolation of these devices from public-facing networks to prevent unauthorized data access.

Description Summary:
An unauthenticated stored cross-site scripting vulnerability in the username parameter of multiple SOUND4 products allows attackers to execute arbitrary scripts in victim browser sessions.

Executive Summary:
An unauthenticated stored cross-site scripting vulnerability in various SOUND4 broadcast products allows remote attackers to execute malicious scripts in victim sessions, posing a significant risk of account compromise.

Vulnerability Details

CVE-ID: CVE-2022-50787

Affected Software: SOUND4 Ltd. IMPACT, FIRST, PULSE, Eco, and related products

Affected Versions: SOUND4 Ltd. Impact/Pulse/First: Version 2: 1.1/2.15; SOUND4 Ltd. Impact/Pulse Eco: 1.16; SOUND4 Ltd. BigVoice4: 1.2; SOUND4 Ltd. BigVoice2: 1.30; SOUND4 Ltd. Stream: 1.1/2.4.29; Kantar Media WM2: 1.11

Vulnerability: This is a stored cross-site scripting (XSS) vulnerability (CWE-79) triggered via the username parameter. The flaw allows an unauthenticated attacker to inject malicious JavaScript, which is then executed within the browser of any user viewing the affected interface.

Business Impact

The ability for an unauthenticated attacker to inject persistent scripts into administrative or user interfaces presents a high risk of session hijacking, unauthorized actions performed on behalf of legitimate users, and potential data theft. Given the CVSS score of 7.2, this vulnerability is classified as High severity. Successful exploitation could lead to full control over the administrative sessions of these broadcast management systems, potentially resulting in operational disruption of broadcast services.

Remediation Plan

Immediate Action: Contact the vendor immediately to obtain the latest security patches for your specific product version, as no official public patch version was provided in the source data.

Proactive Monitoring: Review web server and application access logs for suspicious input patterns within the username field, specifically looking for script tags or encoded character sequences.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict input validation rules configured to block common XSS payloads directed at the username parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the Packet Storm Security reference.

Analyst Notes: As of January 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows for persistent, unauthenticated code injection that remains active until the malicious entry is removed from the database.

Analyst Recommendation

Given the high CVSS score and the existence of a public proof-of-concept, organizations using the affected SOUND4 software should prioritize this issue. Since a direct patch version is not explicitly identified in the provided data, administrators must engage with the vendor support channels immediately to secure their environments. Until a fix is applied, strict access controls and WAF filtering are essential to reduce the attack surface.

Description Summary:
Multiple SOUND4 products contain a network vulnerability allowing unauthenticated attackers to trigger ICMP floods against arbitrary hosts via network command scripts.

Executive Summary:
A critical vulnerability in several SOUND4 products allows unauthenticated attackers to execute unauthorized network commands, posing a significant risk of distributed denial of service attacks.

Vulnerability Details

CVE-ID: CVE-2022-50695

Affected Software: SOUND4 Ltd. IMPACT/FIRST/PULSE/Eco (and related products)

Affected Versions: Impact/Pulse/First: 1.1, 2.15; Impact/Pulse Eco: 1.16; BigVoice4: 1.2; BigVoice2: 1.30; Stream: 1.1, 2.4.29; Kantar Media WM2: 1.11

Vulnerability: The flaw, categorized as CWE-770, exists in PHP scripts (ping.php, traceroute.php, and dns.php) that fail to properly throttle or limit network resource usage, allowing unauthenticated attackers to initiate ICMP traffic floods against external targets.

Business Impact

The ability for an unauthenticated attacker to weaponize these devices for network flooding can lead to significant service degradation or outages for both the target organization and third parties. Given the CVSS score of 9.8, this vulnerability represents a critical risk of being leveraged in malicious botnet activities, potentially resulting in legal liability and severe reputational damage to the affected organization.

Remediation Plan

Immediate Action: Since a specific patch version is not explicitly detailed in the provided data, administrators must restrict access to the web interface of the affected devices to trusted IP ranges only. Contact the vendor directly to obtain the necessary firmware updates that address these insecure PHP scripts.

Proactive Monitoring: Monitor network traffic for unusual spikes in ICMP (ping) traffic originating from these appliances and review web server access logs for repeated requests to ping.php, traceroute.php, or dns.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an edge firewall to block direct external access to the vulnerable PHP files and implement strict rate limiting on all outbound traffic originating from these devices.

Exploitation Status

Public Exploit Available: Yes, a proof of concept is available via Packet Storm Security.

Analyst Notes: As of February 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it provides a functional command interface for network-level attacks without requiring any authentication.

Analyst Recommendation

Due to the critical severity of this vulnerability and the availability of proof of concept code, immediate action is required to isolate affected systems from the public internet. Organizations should treat these appliances as high risk until the vendor provides firmware updates that remove or properly secure the vulnerable network diagnostic scripts.

Description Summary:
An unauthenticated SQL injection vulnerability in the username parameter of index.php allows remote attackers to bypass authentication and access sensitive database information.

Executive Summary:
A critical SQL injection vulnerability exists in multiple SOUND4 products, allowing unauthenticated attackers to bypass authentication and extract unauthorized database information.

Vulnerability Details

CVE-ID: CVE-2022-50694

Affected Software: SOUND4 Ltd. IMPACT, FIRST, PULSE, Eco, BigVoice4, BigVoice2, Stream, and Kantar Media WM2

Affected Versions: See metadata for specific version strings.

Vulnerability: This flaw is an SQL injection (CWE-89) located in the username POST parameter of the index.php script. It allows an unauthenticated attacker to inject arbitrary SQL commands, resulting in authentication bypass and potential data exfiltration.

Business Impact

The ability for an unauthenticated attacker to manipulate backend database queries poses a severe risk to confidentiality and integrity. Successful exploitation could lead to unauthorized access to administrative accounts, exposure of sensitive configuration data, or the compromise of protected user information. With a CVSS score of 8.2, this vulnerability represents a high-severity threat that could lead to full system compromise if the database is leveraged to gain further access.

Remediation Plan

Immediate Action: Contact SOUND4 Ltd. or the respective vendor support channels to obtain the latest security patches for the affected software versions, as no public patch version is currently specified.

Proactive Monitoring: Review web server access logs for suspicious POST requests to index.php containing SQL syntax characters, such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in the username parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided by Packet Storm Security.

Analyst Notes: As of January 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no prior authentication to execute.

Analyst Recommendation

Given the availability of a published proof-of-concept, the risk of exploitation is elevated. Organizations utilizing the affected SOUND4 or Kantar Media products must prioritize identifying their current versions and engaging with the vendor for remediation. Until a patch is applied, ensure that the affected interfaces are not exposed to the public internet and utilize WAF protections to mitigate the risk of unauthorized database access.

Description Summary:
Multiple SOUND4 audio processing products and Kantar Media WM2 contain an insufficient session expiration vulnerability that allows unauthenticated attackers to hijack active user sessions.

Executive Summary:
Several audio processing platforms are vulnerable to session hijacking due to insufficient session expiration, which allows unauthorized access to active user accounts.

Vulnerability Details

CVE-ID: CVE-2022-50692

Affected Software: SOUND4 Ltd. and Kantar Media products (IMPACT, FIRST, PULSE, Eco, BigVoice4, BigVoice2, Stream, and WM2)

Affected Versions: See metadata for full list of specific affected versions.

Vulnerability: The vulnerability is an instance of insufficient session expiration (CWE-613) where the application fails to properly invalidate session tokens. This flaw allows an unauthenticated attacker to reuse older credentials to hijack active sessions and gain unauthorized access to the application.

Business Impact

Successful exploitation of this vulnerability allows an attacker to gain unauthorized access to administrative or user interfaces without requiring valid credentials. This poses a significant risk of data compromise, unauthorized configuration changes to broadcast infrastructure, and potential reputational damage. Given the CVSS score of 7.5, this is considered a high-severity risk that demands immediate attention to prevent unauthorized control of critical audio processing systems.

Remediation Plan

Immediate Action: Contact the vendor, SOUND4 Ltd., or Kantar Media to obtain the latest security updates, as an official patch version was not explicitly provided in the available data. If no patch is currently available, restrict access to the application management interface to trusted internal networks only.

Proactive Monitoring: Monitor system logs for unusual login patterns, concurrent session activity from disparate IP addresses, and unauthorized access attempts to the management console.

Compensating Controls: Deploy a Web Application Firewall (WAF) or equivalent network security control to restrict access to the web management interfaces, and implement strict source IP filtering to prevent unauthorized external access.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Packet Storm Security reference linked in the vulnerability details.

Analyst Notes: As of January 1, 2026, there is no confirmed active exploitation in the wild, however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently exploitable by any network-adjacent attacker due to the lack of proper session management.

Analyst Recommendation

This vulnerability presents a clear risk to the integrity and availability of broadcast audio infrastructure. Security teams should prioritize limiting exposure of these management interfaces immediately. Given the existence of a public proof-of-concept, it is critical to coordinate with the vendors to identify and apply the necessary security updates or configuration changes to ensure session tokens are properly invalidated.