CVE-2022-50694

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-50694
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an SQL injection vulnerability in the 'username' POST parameter of index.php that allows attackers to manipulate database queries. Attackers can inject arbitrary SQL code through the username parameter to bypass authentication and potentially access unauthorized database information.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/247947 Third Party Advisory
https://packetstormsecurity.com/files/170254/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-username-SQL-Injection.html Exploit Third Party Advisory VDB Entry
https://www.sound4.com/ Product
https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-sql-injection-via-username-parameter Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5727.php Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:sound4:impact_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact:2.0:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:sound4:impact_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact:1.0:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:sound4:pulse_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse:2.0:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:sound4:pulse_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse:1.0:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:sound4:first_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:h:sound4:first:2.0:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:sound4:first_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:h:sound4:first:1.0:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:sound4:impact_eco_firmware:1.16:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact_eco:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:sound4:pulse_eco_firmware:1.16:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse_eco:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:sound4:big_voice4_firmware:1.2:*:*:*:*:*:*:*
cpe:2.3:h:sound4:big_voice4:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:sound4:big_voice2_firmware:1.30:*:*:*:*:*:*:*
cpe:2.3:h:sound4:big_voice2:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:sound4:wm2_firmware:1.11:*:*:*:*:*:*:*
cpe:2.3:h:sound4:wm2:-:*:*:*:*:*:*:*

Configuration 12 (hide)

cpe:2.3:a:sound4:stream_extension:2.4.29:*:*:*:*:*:*:*
History

16 Jan 2026, 19:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.2 		v2 : unknown
v3 : 9.8

13 Jan 2026, 15:28

Type Values Removed Values Added
First Time Sound4
Sound4 impact Eco
Sound4 pulse Firmware
Sound4 first Firmware
Sound4 wm2
Sound4 impact
Sound4 big Voice4
Sound4 big Voice2 Firmware
Sound4 pulse
Sound4 big Voice2
Sound4 big Voice4 Firmware
Sound4 pulse Eco
Sound4 impact Eco Firmware
Sound4 impact Firmware
Sound4 stream Extension
Sound4 wm2 Firmware
Sound4 pulse Eco Firmware
Sound4 first
CPE cpe:2.3:h:sound4:pulse:1.0:*:*:*:*:*:*:*
cpe:2.3:o:sound4:wm2_firmware:1.11:*:*:*:*:*:*:*
cpe:2.3:o:sound4:impact_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:h:sound4:first:1.0:*:*:*:*:*:*:*
cpe:2.3:h:sound4:first:2.0:*:*:*:*:*:*:*
cpe:2.3:a:sound4:stream_extension:2.4.29:*:*:*:*:*:*:*
cpe:2.3:o:sound4:impact_eco_firmware:1.16:*:*:*:*:*:*:*
cpe:2.3:o:sound4:first_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:o:sound4:impact_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:o:sound4:big_voice2_firmware:1.30:*:*:*:*:*:*:*
cpe:2.3:o:sound4:pulse_eco_firmware:1.16:*:*:*:*:*:*:*
cpe:2.3:h:sound4:big_voice2:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse_eco:-:*:*:*:*:*:*:*
cpe:2.3:o:sound4:first_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:o:sound4:pulse_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact:2.0:*:*:*:*:*:*:*
cpe:2.3:h:sound4:big_voice4:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse:2.0:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact:1.0:*:*:*:*:*:*:*
cpe:2.3:o:sound4:big_voice4_firmware:1.2:*:*:*:*:*:*:*
cpe:2.3:h:sound4:wm2:-:*:*:*:*:*:*:*
cpe:2.3:o:sound4:pulse_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact_eco:-:*:*:*:*:*:*:*
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/247947 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/247947 - Third Party Advisory
References () https://packetstormsecurity.com/files/170254/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-username-SQL-Injection.html - () https://packetstormsecurity.com/files/170254/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-username-SQL-Injection.html - Exploit, Third Party Advisory, VDB Entry
References () https://www.sound4.com/ - () https://www.sound4.com/ - Product
References () https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-sql-injection-via-username-parameter - () https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-sql-injection-via-username-parameter - Third Party Advisory
References () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5727.php - () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5727.php - Exploit, Third Party Advisory

30 Dec 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-30 23:15

Updated : 2026-01-16 19:16

NVD link : CVE-2022-50694

Mitre link : CVE-2022-50694

CVE.ORG link : CVE-2022-50694

JSON object : View

Products Affected

sound4

  • impact_eco
  • stream_extension
  • impact_firmware
  • first_firmware
  • pulse_eco_firmware
  • wm2_firmware
  • big_voice2
  • big_voice4_firmware
  • impact_eco_firmware
  • impact
  • big_voice2_firmware
  • pulse
  • first
  • pulse_firmware
  • wm2
  • pulse_eco
  • big_voice4
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')