PT-2025-54234 · Pulse+3 · Pulse+3

Published 2025-12-30 · Updated 2026-01-02 · CVE-2022-50696

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below

Description The software includes hardcoded credentials within its server binaries, which cannot be altered through standard device procedures. This allows attackers to gain unauthorized access to the device on both Linux and Windows systems without any user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-50696

Affected Products

Eco

First

Pulse

Sound4 Impact

References · 9

• 🔥 https://packetstormsecurity.com/files/170256/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Hardcoded-Credentials.html · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2022-5729.php · Exploit
• https://osv.dev/vulnerability/CVE-2022-50696 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50696 · Security Note
• https://vulncheck.com/advisories/sound-impactfirstpulseeco-x-hardcoded-credentials-authentication-bypass · Note
• https://twitter.com/CVEnew/status/2006332260598124791 · Twitter Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/247949 · Note
• https://twitter.com/0dayPublishing/status/2007182926270603730 · Twitter Post
• https://sound4.com · Note