CVE-2022-50792

EUVD-2022-55934
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated file disclosure vulnerability that allows remote attackers to access sensitive system files. Attackers can exploit the vulnerability by manipulating the 'file' GET parameter to disclose arbitrary files on the affected device.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
VulnCheckCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 63%
Affected Products (NVD)
VendorProductVersion
sound4impact_firmware
2.15
sound4impact_firmware
1.69
sound4pulse_firmware
2.15
sound4pulse_firmware
1.69
sound4first_firmware
2.15
sound4first_firmware
1.69
sound4impact_eco_firmware
1.16
sound4pulse_eco_firmware
1.16
sound4big_voice4_firmware
1.2
sound4big_voice2_firmware
1.30
sound4wm2_firmware
1.11
sound4stream_extension
2.4.29
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://exchange.xforce.ibmcloud.com/vulnerabilities/247916
https://packetstormsecurity.com/files/170263/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Unauthenticated-File-Disclosure.html
https://www.sound4.com/
https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-file-disclosure-vulnerability
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5736.php