Filtered by vendor Sound4
Subscriptions
Total
25 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-63220 | 1 Sound4 | 2 First, First Firmware | 2026-01-08 | 7.2 High |
| The Sound4 FIRST web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package. The update mechanism fails to validate the integrity of manual.sh, allowing an attacker to inject arbitrary commands by modifying this script and repackaging the firmware. | ||||
| CVE-2022-50692 | 1 Sound4 | 6 Bigvoice2, Bigvoice4, First and 3 more | 2026-01-05 | 7.5 High |
| SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an insufficient session expiration vulnerability that allows attackers to reuse old session credentials. Attackers can exploit weak session management to potentially hijack active user sessions and gain unauthorized access to the application. | ||||
| CVE-2023-53966 | 1 Sound4 | 1 Linkandshare Transmitter | 2025-12-31 | 9.8 Critical |
| SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory stack overflows through maliciously crafted environment variables. Attackers can manipulate the username environment variable with format string payloads to potentially execute arbitrary code and crash the application. | ||||
| CVE-2023-53965 | 1 Sound4 | 1 Server Service | 2025-12-23 | 8.4 High |
| SOUND4 Server Service 4.1.102 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted binary path by inserting malicious code in the system root path that could execute with LocalSystem privileges during service startup. | ||||
| CVE-2025-57431 | 1 Sound4 | 3 Pulse-eco, Pulse-eco Aes67, Pulse-eco Aes67 Firmware | 2025-10-14 | 8.8 High |
| The Sound4 PULSE-ECO AES67 1.22 web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package. The update mechanism fails to validate the integrity of manual.sh, allowing an attacker to inject arbitrary commands by modifying this script and repackaging the firmware. | ||||