CVE-2022-50794
Published: 30 December 2025
Summary
CVE-2022-50794 is a critical-severity OS Command Injection (CWE-78) vulnerability in Sound4 Impact Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by validating and sanitizing the unauthenticated HTTP POST username parameter in index.php and login.php.
Requires timely identification, reporting, and remediation of the specific command injection flaw in SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below.
Boundary protection with web application firewalls or proxies inspects and blocks malicious username payloads targeting the vulnerable login scripts.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated command injection in public-facing web scripts (index.php, login.php) enables exploitation of public-facing application (T1190) and arbitrary Unix shell command execution (T1059.004).
NVD Description
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploit index.php and login.php scripts by injecting arbitrary shell commands through the HTTP POST 'username' parameter to execute system commands.
Deeper analysisAI
CVE-2022-50794 is an unauthenticated command injection vulnerability (CWE-78) in SOUND4 IMPACT, FIRST, PULSE, and Eco versions 2.x and below. The issue affects the index.php and login.php scripts, where attackers can inject arbitrary shell commands through the HTTP POST username parameter to execute system commands on the server.
Any unauthenticated attacker with network access can exploit this vulnerability due to its low attack complexity and lack of required privileges or user interaction, as indicated by its CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation allows remote code execution, potentially granting full control over the affected system with high impacts to confidentiality, integrity, and availability.
Advisories detailing the vulnerability, including potential mitigations, are available from sources such as IBM X-Force Exchange (https://exchange.xforce.ibmcloud.com/vulnerabilities/247914), Packet Storm Security (https://packetstormsecurity.com/files/170266/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-username-Command-Injection.html), VulnCheck (https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-command-injection-via-username), and Zero Science Labs (https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5739.php), as well as the vendor site (https://www.sound4.com/).
Details
- CWE(s)