An unauthenticated stored cross-site scripting vulnerability in various SOUND4 broadcast products allows remote attackers to execute malicious scripts in victim sessions, posing a significant risk of account compromise.

This is a stored cross-site scripting (XSS) vulnerability (CWE-79) triggered via the username parameter. The flaw allows an unauthenticated attacker to inject malicious JavaScript, which is then executed within the browser of any user viewing the affected interface.

The ability for an unauthenticated attacker to inject persistent scripts into administrative or user interfaces presents a high risk of session hijacking, unauthorized actions performed on behalf of legitimate users, and potential data theft. Given the CVSS score of 7.2, this vulnerability is classified as High severity. Successful exploitation could lead to full control over the administrative sessions of these broadcast management systems, potentially resulting in operational disruption of broadcast services.

Immediate Action: Contact the vendor immediately to obtain the latest security patches for your specific product version, as no official public patch version was provided in the source data.

Proactive Monitoring: Review web server and application access logs for suspicious input patterns within the username field, specifically looking for script tags or encoded character sequences.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict input validation rules configured to block common XSS payloads directed at the username parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the Packet Storm Security reference.

Given the high CVSS score and the existence of a public proof-of-concept, organizations using the affected SOUND4 software should prioritize this issue. Since a direct patch version is not explicitly identified in the provided data, administrators must engage with the vendor support channels immediately to secure their environments. Until a fix is applied, strict access controls and WAF filtering are essential to reduce the attack surface.