CVE-2022-50796
Published: 30 December 2025
Summary
CVE-2022-50796 is a critical-severity Path Traversal (CWE-22) vulnerability in Sound4 Impact Firmware. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 30.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2022-50796 is an unauthenticated remote code execution vulnerability affecting SOUND4 IMPACT, FIRST, PULSE, and Eco devices running firmware versions 2.x and below. The issue stems from a path traversal flaw (CWE-22) in the firmware upload functionality, specifically the upload.cgi script, which allows attackers to write arbitrary files to the system with www-data permissions.
Attackers with network access can exploit this vulnerability without authentication, privileges, or user interaction, requiring only low attack complexity. Successful exploitation grants unauthorized access and enables remote code execution, with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), resulting in high confidentiality, integrity, and availability impacts.
Advisories detailing the vulnerability and potential mitigations are available from sources including IBM X-Force Exchange, Packet Storm Security, VulnCheck, and Zero Science Labs. The vendor website at sound4.com is also referenced for further information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-55930
Vulnerability details
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an unauthenticated remote code execution vulnerability in the firmware upload functionality with path traversal flaw. Attackers can exploit the upload.cgi script to write malicious files to the system with www-data permissions, enabling unauthorized access and code…
more
execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated RCE in a public-facing web application (upload.cgi) via path traversal, directly enabling exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents path traversal exploitation in the upload.cgi firmware upload by validating inputs such as file paths to ensure only legitimate locations are written to.
Remediates the specific path traversal flaw in firmware versions <=2.x through timely application of vendor-provided security updates.
Enforces access control to require authentication for the firmware upload functionality, blocking unauthenticated remote exploitation attempts.