CVE-2022-50794
CriticalSummary
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploit index.php and login.php scripts by injecting arbitrary shell commands through the HTTP POST 'username' parameter to execute system commands.
Risk Assessment
The risk for the organization is the possibility of remote arbitrary command execution without authentication, potentially leading to full device compromise and data integrity loss.
Recommendation
It is recommended to immediately update the SOUND4 software to the latest available version and restrict access to management interfaces to trusted networks only.
Original NVD description (English source)
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploit index.php and login.php scripts by injecting arbitrary shell commands through the HTTP POST 'username' parameter to execute system commands.