CVE-2023-53963

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Remote Command Injection

CVSS 9.3 CRITICALEPSS 3.0%CWE-78

Vexday Risk Score

48Atención

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

CVSS 9.3EPSS 3.0%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Ciclo de vida

22 dic 2025Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands through the 'password' parameter. Attackers can exploit the login.php and index.php scripts by injecting shell commands via the 'password' POST parameter to execute commands with web server privileges.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Productos afectados

Kantar Media · WM2 SOUND4 Ltd. · BigVoice2 SOUND4 Ltd. · BigVoice4 SOUND4 Ltd. · Impact/Pulse Eco SOUND4 Ltd. · Impact/Pulse/First SOUND4 Ltd. · Stream

PoCs públicas encontradas — 1

cve_referencewww.exploit-db.com/exploits/51173no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://web.archive.org/web/20221207074555/https://www.sound4.com/https://www.exploit-db.com/exploits/51173 https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-remote-command-injection https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5738.php