CVE-2023-53963
critical · 9.3SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands through the 'password' parameter. Attackers can exploit the login.php and index.php scripts by injecting shell commands via the 'password' POST parameter to execute commands with web server privileges.
9.3
CVSS
3.4%
EPSS (exploit prob.)
88th
EPSS percentile
2025-12-22
Published
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-78
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| sound4 | impact_firmware | 2.15 |
| sound4 | impact | 2.0 |
| sound4 | impact_firmware | 1.69 |
| sound4 | impact | 1.0 |
| sound4 | pulse_firmware | 2.15 |
| sound4 | pulse | 2.0 |
| sound4 | pulse_firmware | 1.69 |
| sound4 | pulse | 1.0 |
| sound4 | first_firmware | 2.15 |
| sound4 | first | 2.0 |
| sound4 | first_firmware | 1.69 |
| sound4 | first | 1.0 |
| sound4 | impact_eco_firmware | 1.16 |
| sound4 | impact_eco | all versions |
| sound4 | pulse_eco_firmware | 1.16 |
| sound4 | pulse_eco | all versions |
| sound4 | big_voice4_firmware | 1.2 |
| sound4 | big_voice4 | all versions |
| sound4 | big_voice2_firmware | 1.30 |
| sound4 | big_voice2 | all versions |
| sound4 | wm2_firmware | 1.11 |
| sound4 | wm2 | all versions |
| sound4 | stream_extension | 2.4.29 |
Check a specific version with /api/v1/cve/match.
References
- https://web.archive.org/web/20221207074555/https://www.sound4.com/
- https://www.exploit-db.com/exploits/51173
- https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-remote-command-injection
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5738.php
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5738.php
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2023-53963