CVE-2022-50792

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated file disclosure vulnerability that allows remote attackers to access sensitive system files. Attackers can exploit the vulnerability by manipulating the 'file' GET parameter to disclose arbitrary files on the affected device.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
SOUND4 Ltd.	Impact/Pulse/First	Version 2: 1.1/2.15
SOUND4 Ltd.	Impact/Pulse Eco	1.16
SOUND4 Ltd.	BigVoice4	1.2
SOUND4 Ltd.	BigVoice2	1.30
SOUND4 Ltd.	Stream	1.1/2.4.29
Kantar Media	WM2	1.11

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/247916Third Party Advisory
https://packetstormsecurity.com/files/170263/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Unauthenticated-File-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
https://www.sound4.com/Product
https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-file-disclosure-vulnerabilityThird Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5736.phpExploit, Third Party Advisory

Timeline

Published: Dec 30, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-507938.8SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an authenticated command injection vulnerability in the www-data-handler.php script that allows CVE-2022-507949.8SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. A CVE-2022-507957.8SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local authenticated users to create m CVE-2022-507969.8SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an unauthenticated remote code execution vulnerability in the firmware upload functionality wit CVE-2022-507976.4Stripe Green Downloads Wordpress Plugin 2.03 contains a persistent cross-site scripting vulnerability allowing remote attackers to inject ma CVE-2022-507997.5Fetch FTP Client 5.8.2 contains a denial of service vulnerability that allows attackers to trigger 100% CPU consumption by sending long serv CVE-2022-508007.5H3C SSL VPN contains a user enumeration vulnerability that allows attackers to identify valid usernames through the 'txtUsrName' POST parame CVE-2022-508014.3JM-DATA ONU JF511-TV version 1.0.67 is vulnerable to authenticated stored cross-site scripting (XSS) attacks, allowing attackers with authen CVE-2022-508026.1ETAP Safety Manager 1.0.0.32 contains a cross-site scripting vulnerability in the 'action' GET parameter that allows unauthenticated attacke CVE-2022-508039.8JM-DATA ONU JF511-TV version 1.0.67 uses default credentials that allow attackers to gain unauthorized access to the device with administrat CVE-2022-508048.8JM-DATA ONU JF511-TV version 1.0.67 is vulnerable to cross-site request forgery (CSRF) attacks, allowing attackers to perform administrative CVE-2022-508058.2Senayan Library Management System 9.0.0 contains a SQL injection vulnerability in the 'class' parameter that allows attackers to inject mali