CVE-2022-50794

KRITISCH 9.8CVE-2022-50794 · Published 30/12/2025 · updated 17/06/2026

Kurz gesagt

CVE-2022-50794 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in stream extension (sound4).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 3.7%, höher als bei 89.6% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
stream extension sound4	`= 2.4.29`	No fix yet

Description

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploit index.php and login.php scripts by injecting arbitrary shell commands through the HTTP POST 'username' parameter to execute system commands.

References

exchange.xforce.ibmcloud.com/vulnerabilities/247914 · Third Party Advisory
packetstormsecurity.com/files/170266/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-username-Command-Injection.html · Exploit
sound4.com · Product
vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-command-injection-via-username · Third Party Advisory
zeroscience.mk/en/vulnerabilities/ZSL-2022-5739.php · Exploit

Weitere Schwachstellen in stream extension

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

stream extension

sound4

= 2.4.29

No fix yet

Description

Weitere Schwachstellen in stream extension

Alle anzeigen →