PT-2025-52700 · Unknown · Sound4 Impact+3

Published 2025-12-22 · Updated 2025-12-23 · CVE-2023-53963

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x

Description The software contains an unauthenticated OS command injection issue that allows remote attackers to execute arbitrary shell commands. This is possible through the 'password' parameter in the login.php and index.php scripts. Attackers can inject shell commands via the password POST parameter, enabling them to execute commands with web server privileges.

Recommendations Versions prior to 2.x should be updated. As a temporary workaround, restrict access to the login.php and index.php scripts to minimize the risk of exploitation. Avoid using the password parameter in the affected API endpoints until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-53963

Affected Products

Sound4 Eco

Sound4 First

Sound4 Impact

Sound4 Pulse

References · 10

• 🔥 https://exploit-db.com/exploits/51173 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2022-5738.php · Exploit
• https://osv.dev/vulnerability/CVE-2023-53963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53963 · Security Note
• https://twitter.com/VulmonFeeds/status/2003313947865154012 · Twitter Post
• https://web.archive.org/web/20221207074555/https://sound4.com · Note
• https://twitter.com/CVEnew/status/2003233932695994617 · Twitter Post
• https://twitter.com/CveFindCom/status/2003234103341023407 · Twitter Post
• https://twitter.com/TheHackerWire/status/2003296088846217440 · Twitter Post
• https://vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-remote-command-injection · Note