PT-2025-38749 · Unknown · Sound4 Pulse-Eco

Publicado 2025-09-22 · Atualizado 2025-09-22 · CVE-2025-57431

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sound4 PULSE-ECO AES67 version 1.22

Description The web-based management interface is susceptible to Remote Code Execution (RCE) through a malicious firmware update package. The system does not properly validate the integrity of the manual.sh script during the update process. This allows an attacker to inject arbitrary commands by modifying this script and repackaging the firmware.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-494

Identificadores relacionados

CVE-2025-57431

Produtos afetados

Sound4 Pulse-Eco

Referências · 5

• 🔥 https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-57431 · Exploit
• https://osv.dev/vulnerability/CVE-2025-57431 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1970178858100879785 · Publicação no Twitter
• https://sound4.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-57431 · Nota de Segurança