critical9.8
CVE-2022-50696
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified through normal device op…
Impact
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified through normal device operations. Attackers can leverage these static credentials to gain unauthorized access to the device across Linux and Windows distributions without requiring user interaction.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sound4 | First Firmware | Versions 2.15, 1.69 |
| Sound4 | Impact Eco Firmware | Version 1.16 |
| Sound4 | Pulse Eco Firmware | Version 1.16 |
| Sound4 | Big Voice4 Firmware | Version 1.2 |
| Sound4 | Big Voice2 Firmware | Version 1.30 |
| Sound4 | Wm2 Firmware | Version 1.11 |
| Sound4 | Impact Firmware | Versions 2.15, 1.69 |
| Sound4 | Pulse Firmware | Versions 2.15, 1.69 |
| Sound4 | Stream Extension | Version 2.4.29 |
Weakness classification
References
- NVD record
- CVE.org record
- https://exchange.xforce.ibmcloud.com/vulnerabilities/247949
- https://packetstormsecurity.com/files/170256/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Hardcoded-Credentials.html
- https://www.sound4.com/
- https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-hardcoded-credentials-authentication-bypass
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5729.php