A high-severity command injection vulnerability in multiple SOUND4 audio processing products allows unauthenticated remote attackers to execute arbitrary code on affected systems.

The flaw is an OS Command Injection (CWE-78) located in the traceroute.php script. While the record notes that local authenticated users can create malicious files, it explicitly confirms that unauthenticated attackers can trigger command execution through a single crafted HTTP POST request.

Successful exploitation of this vulnerability results in full system compromise, as it allows for arbitrary command execution with the privileges of the web server. Given the CVSS score of 8.4, this poses a significant risk to data integrity, system availability, and the confidentiality of sensitive audio processing configurations. An attacker could leverage this access to pivot within the network or disrupt critical broadcast infrastructure.

Immediate Action: Update all affected SOUND4 and Kantar Media devices to the latest firmware versions provided by the vendor, ensuring that the vulnerable traceroute.php script is patched or removed.

Proactive Monitoring: Monitor network traffic for unusual HTTP POST requests directed toward the traceroute.php endpoint and review system logs for signs of unauthorized file creation within the /tmp directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block malicious POST requests containing shell metacharacters or suspicious patterns targeting the traceroute functionality.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the Packet Storm Security advisory.

This vulnerability represents a critical security risk due to the ease of exploitation and the potential for full system takeover. Organizations utilizing the affected audio processing hardware must prioritize firmware updates immediately to eliminate the command injection vector. If patching is not immediately feasible, restrict network access to the management interface to prevent unauthorized external access to the vulnerable endpoint.