CVE-2022-50694

CRITICAL

9.8

Description

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an SQL injection vulnerability in the 'username' POST parameter of index.php that allows attackers to manipulate database queries. Attackers can inject arbitrary SQL code through the username parameter to bypass authentication and potentially access unauthorized database information.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published12/30/2025

Last Modified1/16/2026

Sourcenvd

Honeypot Sightings0

Affected Products

sound4:big_voice2sound4:big_voice2_firmwaresound4:big_voice4sound4:big_voice4_firmwaresound4:firstsound4:first_firmwaresound4:impactsound4:impact_ecosound4:impact_eco_firmwaresound4:impact_firmwaresound4:pulsesound4:pulse_ecosound4:pulse_eco_firmwaresound4:pulse_firmwaresound4:stream_extensionsound4:wm2sound4:wm2_firmware

Weaknesses (CWE)

CWE-89

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/247947(disclosure@vulncheck.com)

https://packetstormsecurity.com/files/170254/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-username-SQL-Injection.html(disclosure@vulncheck.com)

https://www.sound4.com/(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-sql-injection-via-username-parameter(disclosure@vulncheck.com)

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5727.php(disclosure@vulncheck.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.