CVE-2023-53962

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-53962
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated directory traversal vulnerability that allows remote attackers to write arbitrary files through the 'upgfile' parameter in upload.cgi. Attackers can exploit the vulnerability by sending crafted multipart form-data POST requests with directory traversal sequences to write files to unintended system locations.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://web.archive.org/web/20221207074555/https://www.sound4.com/ Product
https://www.exploit-db.com/exploits/51172 Exploit Third Party Advisory VDB Entry
https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-directory-traversal-file-write Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5730.php Exploit Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5730.php Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:sound4:impact_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact:2.0:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:sound4:impact_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact:1.0:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:sound4:pulse_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse:2.0:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:sound4:pulse_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse:1.0:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:sound4:first_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:h:sound4:first:2.0:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:sound4:first_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:h:sound4:first:1.0:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:sound4:impact_eco_firmware:1.16:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact_eco:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:sound4:pulse_eco_firmware:1.16:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse_eco:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:sound4:big_voice4_firmware:1.2:*:*:*:*:*:*:*
cpe:2.3:h:sound4:big_voice4:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:sound4:big_voice2_firmware:1.30:*:*:*:*:*:*:*
cpe:2.3:h:sound4:big_voice2:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:sound4:wm2_firmware:1.11:*:*:*:*:*:*:*
cpe:2.3:h:sound4:wm2:-:*:*:*:*:*:*:*

Configuration 12 (hide)

cpe:2.3:a:sound4:stream_extension:2.4.29:*:*:*:*:*:*:*
History

13 Jan 2026, 18:05

Type Values Removed Values Added
References () https://web.archive.org/web/20221207074555/https://www.sound4.com/ - () https://web.archive.org/web/20221207074555/https://www.sound4.com/ - Product
References () https://www.exploit-db.com/exploits/51172 - () https://www.exploit-db.com/exploits/51172 - Exploit, Third Party Advisory, VDB Entry
References () https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-directory-traversal-file-write - () https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-directory-traversal-file-write - Third Party Advisory
References () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5730.php - () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5730.php - Exploit, Third Party Advisory
CPE cpe:2.3:h:sound4:pulse:1.0:*:*:*:*:*:*:*
cpe:2.3:o:sound4:wm2_firmware:1.11:*:*:*:*:*:*:*
cpe:2.3:o:sound4:impact_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:h:sound4:first:1.0:*:*:*:*:*:*:*
cpe:2.3:h:sound4:first:2.0:*:*:*:*:*:*:*
cpe:2.3:a:sound4:stream_extension:2.4.29:*:*:*:*:*:*:*
cpe:2.3:o:sound4:impact_eco_firmware:1.16:*:*:*:*:*:*:*
cpe:2.3:o:sound4:first_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:o:sound4:impact_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:o:sound4:big_voice2_firmware:1.30:*:*:*:*:*:*:*
cpe:2.3:o:sound4:pulse_eco_firmware:1.16:*:*:*:*:*:*:*
cpe:2.3:h:sound4:big_voice2:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse_eco:-:*:*:*:*:*:*:*
cpe:2.3:o:sound4:first_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:o:sound4:pulse_firmware:2.15:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact:2.0:*:*:*:*:*:*:*
cpe:2.3:h:sound4:big_voice4:-:*:*:*:*:*:*:*
cpe:2.3:h:sound4:pulse:2.0:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact:1.0:*:*:*:*:*:*:*
cpe:2.3:o:sound4:big_voice4_firmware:1.2:*:*:*:*:*:*:*
cpe:2.3:h:sound4:wm2:-:*:*:*:*:*:*:*
cpe:2.3:o:sound4:pulse_firmware:1.69:*:*:*:*:*:*:*
cpe:2.3:h:sound4:impact_eco:-:*:*:*:*:*:*:*
First Time Sound4
Sound4 impact Eco
Sound4 pulse Firmware
Sound4 first Firmware
Sound4 wm2
Sound4 impact
Sound4 big Voice4
Sound4 big Voice2 Firmware
Sound4 pulse
Sound4 big Voice2
Sound4 big Voice4 Firmware
Sound4 pulse Eco
Sound4 impact Eco Firmware
Sound4 impact Firmware
Sound4 stream Extension
Sound4 wm2 Firmware
Sound4 pulse Eco Firmware
Sound4 first

22 Dec 2025, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-22 22:16

Updated : 2026-01-16 19:16

NVD link : CVE-2023-53962

Mitre link : CVE-2023-53962

CVE.ORG link : CVE-2023-53962

JSON object : View

Products Affected

sound4

  • impact_eco
  • stream_extension
  • impact_firmware
  • first_firmware
  • pulse_eco_firmware
  • wm2_firmware
  • big_voice2
  • big_voice4_firmware
  • impact_eco_firmware
  • impact
  • big_voice2_firmware
  • pulse
  • first
  • pulse_firmware
  • wm2
  • pulse_eco
  • big_voice4
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')