CVE-2023-53960

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-53960
SOUND4 IMPACT/FIRST/PULSE/Eco version 2.x contains an SQL injection vulnerability in the 'index.php' authentication mechanism that allows attackers to manipulate login credentials. Attackers can inject malicious SQL code through the 'password' POST parameter to bypass authentication and potentially gain unauthorized access to the system.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://web.archive.org/web/20221207074555/https://www.sound4.com/ Product
https://www.exploit-db.com/exploits/51171 Exploit Third Party Advisory VDB Entry
https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-sql-injection-via-authentication-bypass Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5726.php Exploit Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5726.php Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:sound4:first_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:h:sound4:first:2.0:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:sound4:first_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:h:sound4:first:1.0:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:sound4:impact_eco_firmware:1.16:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact_eco:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:sound4:pulse_eco_firmware:1.16:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse_eco:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:sound4:big_voice4_firmware:1.2:*:*:*:*:*:*:*
cpe:2.3:h:sound4:big_voice4:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:sound4:big_voice2_firmware:1.30:*:*:*:*:*:*:*
cpe:2.3:h:sound4:big_voice2:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:sound4:wm2_firmware:1.11:*:*:*:*:*:*:*
cpe:2.3:h:sound4:wm2:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:sound4:impact_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact:2.0:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:sound4:impact_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact:1.0:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:sound4:pulse_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse:2.0:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:sound4:pulse_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse:1.0:*:*:*:*:*:*:*

Configuration 12 (hide)

cpe:2.3:a:sound4:stream_extension:2.4.29:*:*:*:*:*:*:*
History

16 Jan 2026, 19:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.2 		v2 : unknown
v3 : 9.8

13 Jan 2026, 18:22

Type Values Removed Values Added
References () https://web.archive.org/web/20221207074555/https://www.sound4.com/ - () https://web.archive.org/web/20221207074555/https://www.sound4.com/ - Product
References () https://www.exploit-db.com/exploits/51171 - () https://www.exploit-db.com/exploits/51171 - Exploit, Third Party Advisory, VDB Entry
References () https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-sql-injection-via-authentication-bypass - () https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-sql-injection-via-authentication-bypass - Third Party Advisory
References () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5726.php - () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5726.php - Exploit, Third Party Advisory
CPE cpe:2.3:h:sound4:pulse:1.0:*:*:*:*:*:*:*
cpe:2.3:o:sound4:wm2_firmware:1.11:*:*:*:*:*:*:*
cpe:2.3:o:sound4:impact_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:h:sound4:first:1.0:*:*:*:*:*:*:*
cpe:2.3:h:sound4:first:2.0:*:*:*:*:*:*:*
cpe:2.3:a:sound4:stream_extension:2.4.29:*:*:*:*:*:*:*
cpe:2.3:o:sound4:impact_eco_firmware:1.16:*:*:*:*:*:*:*
cpe:2.3:o:sound4:first_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:o:sound4:big_voice2_firmware:1.30:*:*:*:*:*:*:*
cpe:2.3:o:sound4:impact_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:o:sound4:pulse_eco_firmware:1.16:*:*:*:*:*:*:*
cpe:2.3:h:sound4:big_voice2:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse_eco:-:*:*:*:*:*:*:*
cpe:2.3:o:sound4:first_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:o:sound4:pulse_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact:2.0:*:*:*:*:*:*:*
cpe:2.3:h:sound4:big_voice4:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse:2.0:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact:1.0:*:*:*:*:*:*:*
cpe:2.3:o:sound4:big_voice4_firmware:1.2:*:*:*:*:*:*:*
cpe:2.3:h:sound4:wm2:-:*:*:*:*:*:*:*
cpe:2.3:o:sound4:pulse_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact_eco:-:*:*:*:*:*:*:*
First Time Sound4
Sound4 impact Eco
Sound4 pulse Firmware
Sound4 first Firmware
Sound4 wm2
Sound4 impact
Sound4 big Voice4
Sound4 big Voice2 Firmware
Sound4 pulse
Sound4 big Voice2
Sound4 big Voice4 Firmware
Sound4 pulse Eco
Sound4 impact Eco Firmware
Sound4 impact Firmware
Sound4 stream Extension
Sound4 wm2 Firmware
Sound4 pulse Eco Firmware
Sound4 first

22 Dec 2025, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-22 22:16

Updated : 2026-01-16 19:16

NVD link : CVE-2023-53960

Mitre link : CVE-2023-53960

CVE.ORG link : CVE-2023-53960

JSON object : View

Products Affected

sound4

  • impact_eco
  • stream_extension
  • impact_firmware
  • first_firmware
  • pulse_eco_firmware
  • wm2_firmware
  • pulse_firmware
  • big_voice2
  • big_voice4_firmware
  • impact_eco_firmware
  • big_voice2_firmware
  • impact
  • pulse
  • first
  • wm2
  • pulse_eco
  • big_voice4
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')