high7.5
CVE-2022-50695
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x contains a network vulnerability that allows unauthenticated attackers to send ICMP signals to arbitrary hosts throu…
Impact
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x contains a network vulnerability that allows unauthenticated attackers to send ICMP signals to arbitrary hosts through network command scripts. Attackers can abuse ping.php, traceroute.php, and dns.php to generate network flooding attacks targeting external hosts.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sound4 | Impact Firmware | Versions 2.15, 1.69 |
| Sound4 | Pulse Firmware | Versions 2.15, 1.69 |
| Sound4 | First Firmware | Versions 2.15, 1.69 |
| Sound4 | Impact Eco Firmware | Version 1.16 |
| Sound4 | Stream Extension | Version 2.4.29 |
| Sound4 | Wm2 Firmware | Version 1.11 |
| Sound4 | Big Voice2 Firmware | Version 1.30 |
| Sound4 | Big Voice4 Firmware | Version 1.2 |
| Sound4 | Pulse Eco Firmware | Version 1.16 |
Weakness classification
References
- NVD record
- CVE.org record
- https://exchange.xforce.ibmcloud.com/vulnerabilities/247948
- https://packetstormsecurity.com/files/170255/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-ICMP-Flood-Attack.html
- https://www.sound4.com/
- https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-icmp-flood-attack-via-network-commands
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5728.php