CVE-2023-53961

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Cross-Site Request Forgery

CVSS 5.1 MEDIUMEPSS 0.2%CWE-352

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 5.1EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

22 dic 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages that submit HTTP requests to the radio processing interface, triggering unintended administrative operations when a logged-in user visits the page.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Productos afectados

Kantar Media · WM2 SOUND4 Ltd. · BigVoice2 SOUND4 Ltd. · BigVoice4 SOUND4 Ltd. · Impact/Pulse Eco SOUND4 Ltd. · Impact/Pulse/First SOUND4 Ltd. · Stream

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://web.archive.org/web/20221207074555/https://www.sound4.com/https://www.exploit-db.com/exploits/51168 https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-cross-site-request-forgery https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5722.php