PT-2025-47463 · Unknown · Sound4 First

Published 2025-11-19 · Updated 2026-01-08 · CVE-2025-63220

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sound4 FIRST (affected versions not specified)

Description The Sound4 FIRST web-based management interface is susceptible to Remote Code Execution (RCE) through a maliciously crafted firmware update package. The system’s update process does not properly validate the integrity of the manual.sh script. An attacker can exploit this by modifying the script to include arbitrary commands and then repackaging the firmware to deliver the malicious payload. This allows for the execution of unauthorized code on the affected system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2025-63220

Affected Products

Sound4 First

References · 10

• 🔥 https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63220_Sound4%20FIRST%20RCE · Exploit
• https://osv.dev/vulnerability/CVE-2025-63220 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63220 · Security Note
• https://t.me/cveNotify/148099 · Telegram Post
• https://t.me/cveNotify/143385 · Telegram Post
• https://sound4helpdesk.com · Note
• https://t.me/cveNotify/143467 · Telegram Post
• https://twitter.com/CVEnew/status/1991187303361048955 · Twitter Post
• https://twitter.com/cracbot/status/1992911132638740567 · Twitter Post
• https://sound4helpdesk.com/first-downloads · Note