High severity7.8NVD Advisory· Published Dec 30, 2025· Updated Jun 17, 2026
CVE-2022-50795
CVE-2022-50795
Description
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory. Unauthenticated attackers can execute commands by making a single HTTP POST request to the traceroute.php script, which triggers the malicious file and then deletes it after execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
14- cpe:2.3:a:sound4:stream_extension:2.4.29:*:*:*:*:*:*:*
- cpe:2.3:o:sound4:big_voice2_firmware:1.30:*:*:*:*:*:*:*
- cpe:2.3:o:sound4:big_voice4_firmware:1.2:*:*:*:*:*:*:*
cpe:2.3:o:sound4:first_firmware:1.69:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:sound4:first_firmware:1.69:*:*:*:*:*:*:*
- cpe:2.3:o:sound4:first_firmware:2.15:*:*:*:*:*:*:*
- cpe:2.3:o:sound4:impact_eco_firmware:1.16:*:*:*:*:*:*:*
cpe:2.3:o:sound4:impact_firmware:1.69:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:sound4:impact_firmware:1.69:*:*:*:*:*:*:*
- cpe:2.3:o:sound4:impact_firmware:2.15:*:*:*:*:*:*:*
- cpe:2.3:o:sound4:pulse_eco_firmware:1.16:*:*:*:*:*:*:*
cpe:2.3:o:sound4:pulse_firmware:1.69:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:sound4:pulse_firmware:1.69:*:*:*:*:*:*:*
- cpe:2.3:o:sound4:pulse_firmware:2.15:*:*:*:*:*:*:*
- cpe:2.3:o:sound4:wm2_firmware:1.11:*:*:*:*:*:*:*
<=2.x+ 1 more
- (no CPE)range: <=2.x
- (no CPE)range: Version 2: 1.1/2.15
Patches
Vulnerability mechanics
References
5- packetstormsecurity.com/files/170267/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-traceroute.php-Conditional-Command-Injection.htmlnvdExploitThird Party Advisory
- www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5740.phpnvdExploitThird Party Advisory
- exchange.xforce.ibmcloud.com/vulnerabilities/247950nvdThird Party Advisory
- www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-conditional-command-injection-via-traceroutephpnvdThird Party Advisory
- www.sound4.comnvdProduct
News mentions
0No linked articles in our index yet.