High severity7.8NVD Advisory· Published Dec 30, 2025· Updated Jun 17, 2026
CVE-2022-50789
CVE-2022-50789
Description
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory with .dns.pid extension. Unauthenticated attackers can execute the malicious commands by making a single HTTP POST request to the vulnerable dns.php script, which triggers command execution and then deletes the file.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
14- cpe:2.3:a:sound4:stream_extension:2.4.29:*:*:*:*:*:*:*
- cpe:2.3:o:sound4:big_voice2_firmware:1.30:*:*:*:*:*:*:*
- cpe:2.3:o:sound4:big_voice4_firmware:1.2:*:*:*:*:*:*:*
cpe:2.3:o:sound4:first_firmware:1.69:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:sound4:first_firmware:1.69:*:*:*:*:*:*:*
- cpe:2.3:o:sound4:first_firmware:2.15:*:*:*:*:*:*:*
- cpe:2.3:o:sound4:impact_eco_firmware:1.16:*:*:*:*:*:*:*
cpe:2.3:o:sound4:impact_firmware:1.69:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:sound4:impact_firmware:1.69:*:*:*:*:*:*:*
- cpe:2.3:o:sound4:impact_firmware:2.15:*:*:*:*:*:*:*
- cpe:2.3:o:sound4:pulse_eco_firmware:1.16:*:*:*:*:*:*:*
cpe:2.3:o:sound4:pulse_firmware:1.69:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:sound4:pulse_firmware:1.69:*:*:*:*:*:*:*
- cpe:2.3:o:sound4:pulse_firmware:2.15:*:*:*:*:*:*:*
- cpe:2.3:o:sound4:wm2_firmware:1.11:*:*:*:*:*:*:*
<=2.x+ 1 more
- (no CPE)range: <=2.x
- (no CPE)range: Version 2: 1.1/2.15
Patches
Vulnerability mechanics
References
5- packetstormsecurity.com/files/170260/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-dns.php-Command-Injection.htmlnvdExploitThird Party AdvisoryVDB Entry
- www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5733.phpnvdExploitThird Party Advisory
- exchange.xforce.ibmcloud.com/vulnerabilities/247922nvdThird Party Advisory
- www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-conditional-command-injection-via-dnsphpnvdThird Party Advisory
- www.sound4.comnvdProduct
News mentions
0No linked articles in our index yet.