medium4.3
CVE-2023-53961
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user con…
Impact
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages that submit HTTP requests to the radio processing interface, triggering unintended administrative operations when a logged-in user visits the page.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sound4 | Impact Firmware | Versions 2.15, 1.69 |
| Sound4 | Pulse Firmware | Versions 2.15, 1.69 |
| Sound4 | First Firmware | Versions 2.15, 1.69 |
| Sound4 | Impact Eco Firmware | Version 1.16 |
| Sound4 | Pulse Eco Firmware | Version 1.16 |
| Sound4 | Big Voice4 Firmware | Version 1.2 |
| Sound4 | Big Voice2 Firmware | Version 1.30 |
| Sound4 | Wm2 Firmware | Version 1.11 |
| Sound4 | Stream Extension | Version 2.4.29 |
Weakness classification
References
- NVD record
- CVE.org record
- https://web.archive.org/web/20221207074555/https://www.sound4.com/
- https://www.exploit-db.com/exploits/51168
- https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-cross-site-request-forgery
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5722.php
- https://www.exploit-db.com/exploits/51168
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5722.php