PT-2025-38749 · Unknown · Sound4 Pulse-Eco

Published 2025-09-22 · Updated 2025-09-22 · CVE-2025-57431

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sound4 PULSE-ECO AES67 version 1.22

Description The web-based management interface is susceptible to Remote Code Execution (RCE) through a malicious firmware update package. The system does not properly validate the integrity of the manual.sh script during the update process. This allows an attacker to inject arbitrary commands by modifying this script and repackaging the firmware.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2025-57431

Affected Products

Sound4 Pulse-Eco

References · 5

• 🔥 https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-57431 · Exploit
• https://osv.dev/vulnerability/CVE-2025-57431 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57431 · Security Note
• https://twitter.com/CVEnew/status/1970178858100879785 · Twitter Post
• https://sound4.com · Note