High severity7.2NVD Advisory· Published Nov 19, 2025· Updated Jun 17, 2026
CVE-2025-63220
CVE-2025-63220
Description
The Sound4 FIRST web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package. The update mechanism fails to validate the integrity of manual.sh, allowing an attacker to inject arbitrary commands by modifying this script and repackaging the firmware.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:o:sound4:first_firmware:2.33:*:*:*:*:*:*:*
- Sound4/FIRST web-based management interfacedescription
Patches
Vulnerability mechanics
References
3- github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63220_Sound4%20FIRST%20RCEnvdExploitThird Party Advisory
- www.sound4helpdesk.comnvdProduct
- www.sound4helpdesk.com/first-downloads/nvdProduct
News mentions
0No linked articles in our index yet.