SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands through the 'password' parameter. Attackers can exploit the login.php and index.php scripts by injecting shell commands via the 'password' POST parameter to execute commands with web server privileges.
References
| Link | Resource |
|---|---|
| https://web.archive.org/web/20221207074555/https://www.sound4.com/ | Product |
| https://www.exploit-db.com/exploits/51173 | Exploit Third Party Advisory VDB Entry |
| https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-remote-command-injection | Third Party Advisory |
| https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5738.php | Exploit Third Party Advisory |
| https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5738.php | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
Configuration 5 (hide)
| AND |
|
Configuration 6 (hide)
| AND |
|
Configuration 7 (hide)
| AND |
|
Configuration 8 (hide)
| AND |
|
Configuration 9 (hide)
| AND |
|
Configuration 10 (hide)
| AND |
|
Configuration 11 (hide)
| AND |
|
Configuration 12 (hide)
|
History
13 Jan 2026, 15:42
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sound4
Sound4 impact Eco Sound4 pulse Firmware Sound4 first Firmware Sound4 wm2 Sound4 impact Sound4 big Voice4 Sound4 big Voice2 Firmware Sound4 pulse Sound4 big Voice2 Sound4 big Voice4 Firmware Sound4 pulse Eco Sound4 impact Eco Firmware Sound4 impact Firmware Sound4 stream Extension Sound4 wm2 Firmware Sound4 pulse Eco Firmware Sound4 first |
|
| References | () https://web.archive.org/web/20221207074555/https://www.sound4.com/ - Product | |
| References | () https://www.exploit-db.com/exploits/51173 - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-remote-command-injection - Third Party Advisory | |
| References | () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5738.php - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:h:sound4:pulse:1.0:*:*:*:*:*:*:* cpe:2.3:o:sound4:wm2_firmware:1.11:*:*:*:*:*:*:* cpe:2.3:o:sound4:impact_firmware:2.15:*:*:*:*:*:*:* cpe:2.3:h:sound4:first:1.0:*:*:*:*:*:*:* cpe:2.3:h:sound4:first:2.0:*:*:*:*:*:*:* cpe:2.3:a:sound4:stream_extension:2.4.29:*:*:*:*:*:*:* cpe:2.3:o:sound4:impact_eco_firmware:1.16:*:*:*:*:*:*:* cpe:2.3:o:sound4:first_firmware:2.15:*:*:*:*:*:*:* cpe:2.3:o:sound4:impact_firmware:1.69:*:*:*:*:*:*:* cpe:2.3:o:sound4:big_voice2_firmware:1.30:*:*:*:*:*:*:* cpe:2.3:o:sound4:pulse_eco_firmware:1.16:*:*:*:*:*:*:* cpe:2.3:h:sound4:big_voice2:-:*:*:*:*:*:*:* cpe:2.3:h:sound4:pulse_eco:-:*:*:*:*:*:*:* cpe:2.3:o:sound4:first_firmware:1.69:*:*:*:*:*:*:* cpe:2.3:o:sound4:pulse_firmware:2.15:*:*:*:*:*:*:* cpe:2.3:h:sound4:impact:2.0:*:*:*:*:*:*:* cpe:2.3:h:sound4:big_voice4:-:*:*:*:*:*:*:* cpe:2.3:h:sound4:pulse:2.0:*:*:*:*:*:*:* cpe:2.3:h:sound4:impact:1.0:*:*:*:*:*:*:* cpe:2.3:o:sound4:big_voice4_firmware:1.2:*:*:*:*:*:*:* cpe:2.3:h:sound4:wm2:-:*:*:*:*:*:*:* cpe:2.3:o:sound4:pulse_firmware:1.69:*:*:*:*:*:*:* cpe:2.3:h:sound4:impact_eco:-:*:*:*:*:*:*:* |
22 Dec 2025, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-22 22:16
Updated : 2026-01-13 15:42
NVD link : CVE-2023-53963
Mitre link : CVE-2023-53963
CVE.ORG link : CVE-2023-53963
JSON object : View
Products Affected
sound4
- impact_eco
- stream_extension
- impact_firmware
- first_firmware
- pulse_eco_firmware
- wm2_firmware
- big_voice2
- big_voice4_firmware
- impact_eco_firmware
- impact
- big_voice2_firmware
- pulse
- first
- pulse_firmware
- wm2
- pulse_eco
- big_voice4
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')