CVE-2022-50787

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-50787
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x contains an unauthenticated stored cross-site scripting vulnerability in the username parameter that allows attackers to inject malicious scripts. Attackers can exploit the unvalidated username input to execute arbitrary HTML and JavaScript code in victim browser sessions without authentication.

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/247920 Third Party Advisory
https://packetstormsecurity.com/files/170258/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Persistent-Cross-Site-Scripting.html Exploit Third Party Advisory VDB Entry
https://www.sound4.com/ Product
https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-stored-cross-site-scripting Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5731.php Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:sound4:impact_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact:2.0:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:sound4:impact_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact:1.0:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:sound4:pulse_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse:2.0:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:sound4:pulse_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse:1.0:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:sound4:first_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:h:sound4:first:2.0:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:sound4:first_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:h:sound4:first:1.0:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:sound4:impact_eco_firmware:1.16:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact_eco:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:sound4:pulse_eco_firmware:1.16:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse_eco:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:sound4:big_voice4_firmware:1.2:*:*:*:*:*:*:*
cpe:2.3:h:sound4:big_voice4:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:sound4:big_voice2_firmware:1.30:*:*:*:*:*:*:*
cpe:2.3:h:sound4:big_voice2:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:sound4:wm2_firmware:1.11:*:*:*:*:*:*:*
cpe:2.3:h:sound4:wm2:-:*:*:*:*:*:*:*

Configuration 12 (hide)

cpe:2.3:a:sound4:stream_extension:2.4.29:*:*:*:*:*:*:*
History

13 Jan 2026, 15:12

Type Values Removed Values Added
CPE cpe:2.3:h:sound4:pulse:1.0:*:*:*:*:*:*:*
cpe:2.3:o:sound4:wm2_firmware:1.11:*:*:*:*:*:*:*
cpe:2.3:o:sound4:impact_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:h:sound4:first:1.0:*:*:*:*:*:*:*
cpe:2.3:h:sound4:first:2.0:*:*:*:*:*:*:*
cpe:2.3:a:sound4:stream_extension:2.4.29:*:*:*:*:*:*:*
cpe:2.3:o:sound4:impact_eco_firmware:1.16:*:*:*:*:*:*:*
cpe:2.3:o:sound4:first_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:o:sound4:impact_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:o:sound4:big_voice2_firmware:1.30:*:*:*:*:*:*:*
cpe:2.3:o:sound4:pulse_eco_firmware:1.16:*:*:*:*:*:*:*
cpe:2.3:h:sound4:big_voice2:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse_eco:-:*:*:*:*:*:*:*
cpe:2.3:o:sound4:first_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:o:sound4:pulse_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact:2.0:*:*:*:*:*:*:*
cpe:2.3:h:sound4:big_voice4:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse:2.0:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact:1.0:*:*:*:*:*:*:*
cpe:2.3:o:sound4:big_voice4_firmware:1.2:*:*:*:*:*:*:*
cpe:2.3:h:sound4:wm2:-:*:*:*:*:*:*:*
cpe:2.3:o:sound4:pulse_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact_eco:-:*:*:*:*:*:*:*
First Time Sound4
Sound4 impact Eco
Sound4 pulse Firmware
Sound4 first Firmware
Sound4 wm2
Sound4 impact
Sound4 big Voice4
Sound4 big Voice2 Firmware
Sound4 pulse
Sound4 big Voice2
Sound4 big Voice4 Firmware
Sound4 pulse Eco
Sound4 impact Eco Firmware
Sound4 impact Firmware
Sound4 stream Extension
Sound4 wm2 Firmware
Sound4 pulse Eco Firmware
Sound4 first
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/247920 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/247920 - Third Party Advisory
References () https://packetstormsecurity.com/files/170258/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Persistent-Cross-Site-Scripting.html - () https://packetstormsecurity.com/files/170258/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Persistent-Cross-Site-Scripting.html - Exploit, Third Party Advisory, VDB Entry
References () https://www.sound4.com/ - () https://www.sound4.com/ - Product
References () https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-stored-cross-site-scripting - () https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-stored-cross-site-scripting - Third Party Advisory
References () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5731.php - () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5731.php - Exploit, Third Party Advisory

30 Dec 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-30 23:15

Updated : 2026-01-13 15:12

NVD link : CVE-2022-50787

Mitre link : CVE-2022-50787

CVE.ORG link : CVE-2022-50787

JSON object : View

Products Affected

sound4

  • impact_eco
  • stream_extension
  • impact_firmware
  • first_firmware
  • pulse_eco_firmware
  • wm2_firmware
  • big_voice2
  • big_voice4_firmware
  • impact_eco_firmware
  • impact
  • big_voice2_firmware
  • pulse
  • first
  • pulse_firmware
  • wm2
  • pulse_eco
  • big_voice4
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')