CVE-2023-53955

EUVD-2023-60244
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows attackers to bypass authorization and access hidden system resources. Attackers can exploit the vulnerability by manipulating user-supplied input to execute privileged functionalities without proper authentication.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheckCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 67%
Affected Products (NVD)
VendorProductVersion
sound4impact_firmware
2.15
sound4impact_firmware
1.69
sound4pulse_firmware
2.15
sound4pulse_firmware
1.69
sound4first_firmware
2.15
sound4first_firmware
1.69
sound4impact_eco_firmware
1.16
sound4pulse_eco_firmware
1.16
sound4big_voice4_firmware
1.2
sound4big_voice2_firmware
1.30
sound4wm2_firmware
1.11
sound4stream_extension
2.4.29
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://web.archive.org/web/20221207074555/https://www.sound4.com/
https://www.exploit-db.com/exploits/51169
https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-authorization-bypass-via-insecure-object-references
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5723.php
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5723.php