CVE-2023-53960
Published: 22 December 2025
Summary
CVE-2023-53960 is a critical-severity SQL Injection (CWE-89) vulnerability in Sound4 First Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection attacks by requiring validation of untrusted inputs like the password POST parameter in the authentication mechanism.
Mandates timely remediation of the identified SQL injection flaw in index.php to eliminate the vulnerability.
Enables boundary protections such as web application firewalls to filter and block malicious SQL payloads targeting the login interface.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web login (index.php) enables remote authentication bypass, directly facilitating T1190: Exploit Public-Facing Application.
NVD Description
SOUND4 IMPACT/FIRST/PULSE/Eco version 2.x contains an SQL injection vulnerability in the 'index.php' authentication mechanism that allows attackers to manipulate login credentials. Attackers can inject malicious SQL code through the 'password' POST parameter to bypass authentication and potentially gain unauthorized access…
more
to the system.
Deeper analysisAI
CVE-2023-53960 is an SQL injection vulnerability (CWE-89) in the authentication mechanism of SOUND4 IMPACT, FIRST, PULSE, and Eco versions 2.x. The issue affects the 'index.php' file, where attackers can inject malicious SQL code via the 'password' POST parameter to manipulate login credentials. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with high impacts on confidentiality, integrity, and availability.
Remote attackers with no privileges or user interaction can exploit this vulnerability over the network with low complexity. By submitting crafted SQL payloads in the password field during login attempts, they can bypass authentication and gain unauthorized access to the system.
Advisories from VulnCheck and Zero Science Lab (ZSL-2022-5726) describe the SQL injection via authentication bypass, while a proof-of-concept exploit is publicly available on Exploit-DB (exploit 51171). No specific patch or mitigation details are provided in the referenced advisories.
Details
- CWE(s)