CVE-2022-50795

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory. Unauthenticated attackers can execute commands by making a single HTTP POST request to the traceroute.php script, which triggers the malicious file and then deletes it after execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
SOUND4 Ltd.	Impact/Pulse/First	Version 2: 1.1/2.15
SOUND4 Ltd.	Impact/Pulse Eco	1.16
SOUND4 Ltd.	BigVoice4	1.2
SOUND4 Ltd.	BigVoice2	1.30
SOUND4 Ltd.	Stream	1.1/2.4.29
Kantar Media	WM2	1.11

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/247950Third Party Advisory
https://packetstormsecurity.com/files/170267/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-traceroute.php-Conditional-Command-Injection.htmlExploit, Third Party Advisory
https://www.sound4.com/Product
https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-conditional-command-injection-via-traceroutephpThird Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5740.phpExploit, Third Party Advisory

Timeline

Published: Dec 30, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-507969.8SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an unauthenticated remote code execution vulnerability in the firmware upload functionality wit CVE-2022-507976.4Stripe Green Downloads Wordpress Plugin 2.03 contains a persistent cross-site scripting vulnerability allowing remote attackers to inject ma CVE-2022-507997.5Fetch FTP Client 5.8.2 contains a denial of service vulnerability that allows attackers to trigger 100% CPU consumption by sending long serv CVE-2022-508007.5H3C SSL VPN contains a user enumeration vulnerability that allows attackers to identify valid usernames through the 'txtUsrName' POST parame CVE-2022-508014.3JM-DATA ONU JF511-TV version 1.0.67 is vulnerable to authenticated stored cross-site scripting (XSS) attacks, allowing attackers with authen CVE-2022-508026.1ETAP Safety Manager 1.0.0.32 contains a cross-site scripting vulnerability in the 'action' GET parameter that allows unauthenticated attacke CVE-2022-508039.8JM-DATA ONU JF511-TV version 1.0.67 uses default credentials that allow attackers to gain unauthorized access to the device with administrat CVE-2022-508048.8JM-DATA ONU JF511-TV version 1.0.67 is vulnerable to cross-site request forgery (CSRF) attacks, allowing attackers to perform administrative CVE-2022-508058.2Senayan Library Management System 9.0.0 contains a SQL injection vulnerability in the 'class' parameter that allows attackers to inject mali CVE-2022-508067.24images 1.9 contains a remote command execution vulnerability that allows authenticated administrators to inject reverse shell code through CVE-2022-508088.4CoolerMaster MasterPlus 1.8.5 contains an unquoted service path vulnerability in the MPService that allows local attackers to execute code w CVE-2022-50809In the Linux kernel, the following vulnerability has been resolved: xhci: dbc: Fix memory leak in xhci_alloc_dbc() If DbC is already in us