CVE-2022-50794

CRITICAL 9.8CVE-2022-50794 · Published 30/12/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
stream extension sound4	`= 2.4.29`	No fix yet

Description

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploit index.php and login.php scripts by injecting arbitrary shell commands through the HTTP POST 'username' parameter to execute system commands.

References

exchange.xforce.ibmcloud.com/vulnerabilities/247914 · Third Party Advisory
packetstormsecurity.com/files/170266/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-username-Command-Injection.html · Exploit
sound4.com · Product
vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-command-injection-via-username · Third Party Advisory
zeroscience.mk/en/vulnerabilities/ZSL-2022-5739.php · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free