CVE-2023-53960
CriticalSummary
SOUND4 IMPACT/FIRST/PULSE/Eco version 2.x contains an SQL injection vulnerability in the 'index.php' authentication mechanism that allows attackers to manipulate login credentials. Attackers can inject malicious SQL code through the 'password' POST parameter to bypass authentication and potentially gain unauthorized access to the system.
Risk Assessment
The risk for the organization is the possibility of unauthorized access to the system, which can lead to data breaches, configuration changes, or takeover of the device.
Recommendation
It is recommended to immediately update the SOUND4 software to a version that eliminates the SQL injection vulnerability, and to use strong, unique passwords and restrict access to the management interface.
Original NVD description (English source)
SOUND4 IMPACT/FIRST/PULSE/Eco version 2.x contains an SQL injection vulnerability in the 'index.php' authentication mechanism that allows attackers to manipulate login credentials. Attackers can inject malicious SQL code through the 'password' POST parameter to bypass authentication and potentially gain unauthorized access to the system.