PT-2025-52702 · Unknown · Sound4 Server Service

Published 2025-12-22 · Updated 2025-12-23 · CVE-2023-53965

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SOUND4 Server Service version 4.1.102

Description SOUND4 Server Service version 4.1.102 contains an unquoted service path issue that may allow local users with limited privileges to execute code with higher system privileges. An attacker can exploit the unquoted binary path by placing malicious code in the system root path, which could then execute with LocalSystem privileges when the service starts.

Recommendations Versions prior to 4.1.102 are not affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2023-53965

Affected Products

Sound4 Server Service

References · 10

• 🔥 https://exploit-db.com/exploits/51167 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2022-5721.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-53965 · Security Note
• https://osv.dev/vulnerability/CVE-2023-53965 · Vendor Advisory
• https://web.archive.org/web/20221207074555/https://sound4.com · Note
• https://vulncheck.com/advisories/sound-server-service-local-privilege-escalation-via-unquoted-service-path · Note
• https://twitter.com/TheHackerWire/status/2003386063755284502 · Twitter Post
• https://t.me/CVEtracker/40433 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2003306268362998187 · Twitter Post
• https://twitter.com/CVEnew/status/2003233952296018427 · Twitter Post