by Kastro
Paper/Archive/CVE-2022-50696

CVE-2022-50696

SOUND4 Ltd. Impact/Pulse/First — SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Hardcoded Credentials Authentication Bypass

EPSS 0.6%public exploitCVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 48.4.484 × 209.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified through normal device operations. Attackers can leverage these static credentials to gain unauthorized access to the device across Linux and Windows distributions without requiring user interaction.

Affected

ProductAffectedFixed inSource
Impact/Pulse/FirstVersion 2: 1.1/2.15–CNA
Impact/Pulse Eco1.16–CNA
BigVoice41.2–CNA
BigVoice21.30–CNA
Stream1.1/2.4.29–CNA
WM21.11–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refsound4.comwriteupvulncheck.com/advisories/sound-impactfirstpulseeco-x-hardcoded-credentials-authentication-bypasswriteupzeroscience.mk/en/vulnerabilities/ZSL-2022-5729.phpexploitpacketstormsecurity.com/files/170256/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Hardcoded-Credentials.htmlrefexchange.xforce.ibmcloud.com/vulnerabilities/247949