PT-2025-47408 · Unknown · Sound4 Impact

Published 2025-11-18 · Updated 2025-11-19 · CVE-2025-63215

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sound4 IMPACT (affected versions not specified)

Description The Sound4 IMPACT web-based management interface contains a flaw that allows for Remote Code Execution (RCE). This occurs because the system does not properly validate the integrity of the manual.sh script during a firmware update. An attacker can exploit this by modifying the script to include arbitrary commands and then repackaging the firmware, leading to potential system compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2025-63215

Affected Products

Sound4 Impact

References · 9

• 🔥 https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63215%20_%20Sound4%20IMPACT%20%20RCE · Exploit
• https://osv.dev/vulnerability/CVE-2025-63215 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63215 · Security Note
• https://t.me/CVEtracker/37678 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1990984572184531384 · Twitter Post
• https://t.me/cveNotify/143378 · Telegram Post
• https://sound4helpdesk.com · Note
• https://twitter.com/CVEnew/status/1991043001737515378 · Twitter Post
• https://sound4helpdesk.com/impact-downloads · Note