CVE-2022-50692

EUVD-2022-55943
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an insufficient session expiration vulnerability that allows attackers to reuse old session credentials. Attackers can exploit weak session management to potentially hijack active user sessions and gain unauthorized access to the application.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
VulnCheckCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 20%
Affected Products (NVD)
VendorProductVersion
sound4impact_firmware
2.15
sound4impact_firmware
1.69
sound4pulse_firmware
2.15
sound4pulse_firmware
1.69
sound4first_firmware
2.15
sound4first_firmware
1.69
sound4impact_eco_firmware
1.16
sound4pulse_eco_firmware
1.16
sound4big_voice4_firmware
1.2
sound4big_voice2_firmware
1.30
sound4wm2_firmware
1.11
sound4stream_extension
2.4.29
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://cxsecurity.com/issue/WLB-2022120030
https://exchange.xforce.ibmcloud.com/vulnerabilities/247956
https://packetstormsecurity.com/files/170251/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Insufficient-Session-Expiration.html
https://www.sound4.com/
https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-insufficient-session-expiration-vulnerability
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5724.php