PT-2025-54238 · Webplay+2 · Webplay+5

Published 2025-12-30 · Updated 2025-12-31 · CVE-2022-50790

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below

Description A vulnerability exists that allows remote attackers to access live radio stream information without authentication. Attackers can exploit this by calling specific web scripts to disclose radio stream details. The vulnerability affects webplay and ffmpeg scripts.

Recommendations Upgrade to versions 3.x.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-50790

Affected Products

Sound4 Eco

Sound4 First

Sound4 Impact

Sound4 Pulse

Ffmpeg

Webplay

References · 9

• 🔥 https://packetstormsecurity.com/files/170261/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Radio-Steam-Disclosure.html · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2022-5734.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-50790 · Security Note
• https://osv.dev/vulnerability/CVE-2022-50790 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/247923 · Note
• https://twitter.com/CVEnew/status/2006332256089235752 · Twitter Post
• https://sound4.com · Note
• https://twitter.com/CveFindCom/status/2006148283316555946 · Twitter Post
• https://vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-radio-stream-disclosure · Note