External risk intelligence

SOUND4 IMPACT/FIRST/PULSE/Eco Remote Code Execution via Path Traversal

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2022-50796

The vulnerability resides in a web-based upload script within specialized audio appliances. As these devices are typically managed via web interfaces, they are frequently exposed to network or internet access, making the management interface reachable to potential attackers.

Path Traversal

Sound4 Impact Firmware

2.151.691.161.21.301.112.4.29

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in SOUND4 IMPACT/FIRST/PULSE/Eco devices that allows unauthenticated remote code execution. This flaw, stemming from a path traversal issue in the firmware upload functionality, enables attackers to write malicious files to the system. This could lead to unauthorized access and control of the affected devices.

Unauthenticated remote code execution in device firmware.
High severity, impacting device control and access.
Confirm relevance and exposure to Sound4 devices.

Attack Path

How an attacker could exploit the issue

An attacker can exploit a flaw in the firmware upload functionality of certain SOUND4 devices to gain unauthorized remote code execution. By targeting the `upload.cgi` script, an attacker can traverse directories to write malicious files to the system with elevated privileges, ultimately leading to the execution of arbitrary code.

No authentication required.
Upload a malicious file via `upload.cgi`.
Remote code execution and unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

The firmware upload functionality in these audio devices could be exploited by unauthenticated attackers. This could allow malicious files to be written to the system, leading to unauthorized access and code execution.

System firmware could be altered.
Attackers may write malicious files remotely.
Unauthorized code execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The unauthenticated remote code execution vulnerability in SOUND4 IMPACT/FIRST/PULSE/Eco firmware impacts audio appliances, likely managed by infrastructure or platform teams responsible for these devices. The first practical step is to identify all instances of the affected firmware, determine their network exposure, and ascertain their business criticality to prioritize remediation efforts.

Own by infrastructure or platform teams.
Verify device reachability and criticality.
Plan coordinated firmware updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SOUND4 IMPACT, FIRST, PULSE, and Eco?

These are specialized audio processing appliances used in professional broadcasting and streaming environments. They handle tasks like audio encoding, processing, and distribution. The affected firmware runs on these hardware units, managing the core logic, web-based control interfaces, and system-level operations required to maintain audio streams.

What does path traversal mean in CVE-2022-50796?

This vulnerability involves an Improper Limitation of a Pathname to a Restricted Directory, classified as CWE-22. In this context, it means the software fails to properly sanitize user input when processing file uploads. An attacker can use special characters to step outside the intended upload directory, allowing them to overwrite critical system files and execute their own code.

How can an attacker trigger this vulnerability?

An unauthenticated attacker interacts directly with the upload.cgi script provided by the device's web interface. By sending a specially crafted request to this script, they bypass the expected file upload restrictions. Simply accessing the web interface without attempting to upload a file does not trigger the bug, as it specifically requires abusing the firmware upload mechanism to write malicious files.

Why is this device network access a security concern?

Halo Surface Signal notes that these audio appliances are frequently managed via web interfaces reachable over a network or the internet. Because the vulnerability allows for unauthenticated access, any device with a management interface exposed to an untrusted network is at higher risk. This makes verifying the network visibility of your specific devices a critical first step.

What steps should I take if I use this equipment?

Start by conducting an inventory to identify every device running the affected firmware versions. Once you have identified these assets, check their network configurations to determine if they are exposed to the open internet. Prioritize moving exposed management interfaces behind restricted network controls, and contact the manufacturer to verify available firmware updates to patch the upload.cgi function.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.