CVE-2023-53963

CRITICAL 9.8CVE-2023-53963 · Published 22/12/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
stream extension sound4	`= 2.4.29`	No fix yet

Description

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands through the 'password' parameter. Attackers can exploit the login.php and index.php scripts by injecting shell commands via the 'password' POST parameter to execute commands with web server privileges.

References

web.archive.org/web/20221207074555/https://www.sound4.com · Product
exploit-db.com/exploits/51173 · Exploit
vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-remote-command-injection · Third Party Advisory
zeroscience.mk/en/vulnerabilities/ZSL-2022-5738.php · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free