CVE-2022-50793
Published: 30 December 2025
Summary
CVE-2022-50793 is a high-severity OS Command Injection (CWE-78) vulnerability in Sound4 Impact Firmware. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 15.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2022-50793 is an authenticated command injection vulnerability (CWE-78) in SOUND4 IMPACT, FIRST, PULSE, and Eco devices running versions <=2.x. The issue exists in the www-data-handler.php script, which processes the 'services' POST parameter without proper sanitization, enabling attackers to inject and execute arbitrary system commands with www-data user privileges.
Exploitation requires low-privileged authenticated access (PR:L) over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), as reflected in its CVSS v3.1 base score of 8.8 (High). Successful attacks allow remote command execution in a single-instance context (S:U), resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H).
Advisories from VulnCheck, Zero Science Lab, IBM X-Force Exchange, and Packet Storm Security detail the vulnerability, including proof-of-concept exploits, while the vendor site at sound4.com is referenced for potential updates or patches. Practitioners should consult these sources for mitigation guidance.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-55933
Vulnerability details
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an authenticated command injection vulnerability in the www-data-handler.php script that allows attackers to inject system commands through the 'services' POST parameter. Attackers can exploit this vulnerability by crafting malicious 'services' parameter values to execute arbitrary system…
more
commands with www-data user privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an authenticated command injection in a PHP script allowing arbitrary system command execution as www-data (Unix/Linux environment), directly enabling T1059.004: Unix Shell.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the command injection by requiring validation and sanitization of the 'services' POST parameter in www-data-handler.php to block malicious inputs.
Remediates the specific flaw in the vulnerable PHP script through timely identification, reporting, and patching of the CVE.
Limits damage from injected commands by enforcing least privilege on the www-data user executing the arbitrary system commands.