CVE-2023-53962
Published: 22 December 2025
Summary
CVE-2023-53962 is a high-severity Path Traversal (CWE-22) vulnerability in Sound4 Impact Firmware. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 40.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated directory traversal vulnerability that permits remote attackers to write arbitrary files via the 'upgfile' parameter in upload.cgi. The flaw is tracked as CWE-22 and carries a CVSS 4.0 score of 8.8, reflecting network attack vector, low complexity, and no required authentication or user interaction.
Attackers can exploit the issue by submitting specially crafted multipart form-data POST requests that include directory traversal sequences, allowing files to be placed in arbitrary system locations outside the intended upload directory.
Public references include an Exploit-DB entry, a Zero Science disclosure (ZSL-2022-5730), and a VulnCheck advisory, but no vendor-supplied patches or mitigation guidance are documented in the available sources. The EPSS score remains flat at 0.0530 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-60247
Vulnerability details
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated directory traversal vulnerability that allows remote attackers to write arbitrary files through the 'upgfile' parameter in upload.cgi. Attackers can exploit the vulnerability by sending crafted multipart form-data POST requests with directory traversal sequences to…
more
write files to unintended system locations.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.