Cyber Resilience

CVE-2023-53965

HighPublic PoC

Published: 22 December 2025

Published
22 December 2025
Modified
29 January 2026
KEV Added
—
Patch
—
CVSS Score v4 8.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0020 10.2th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-53965 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Sound4 Impact Firmware. Its CVSS base score is 8.6 (High).

Operationally, ranked at the 10.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

SOUND4 Server Service 4.1.102 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted binary path by inserting malicious code in the system root path that…

more

could execute with LocalSystem privileges during service startup.

CWE(s)
CWE-428

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

sound4
impact firmware
4.1.102
sound4
pulse firmware
4.1.102
sound4
first firmware
4.1.102
sound4
impact eco firmware
4.1.102
sound4
pulse eco firmware
4.1.102
sound4
big voice firmware
4.1.102
sound4
voice ula2 firmware
4.1.102
sound4
voice ula4 firmware
4.1.102
sound4
voice ula8 firmware
4.1.102
sound4
ip connect firmware
4.1.102
+5 more product configuration(s) — see NVD for full list

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References