CVE-2022-50789
HIGH
中文标题:
（暂无数据）
英文标题:
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via dns.php
CVSS分数:
8.5
发布时间:
2025-12-30 22:41:36
漏洞类型:
（暂无数据）
状态:
PUBLISHED
数据质量分数:
0.40
数据版本:
v3
漏洞描述
中文描述:
（暂无数据）
英文描述:
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory with .dns.pid extension. Unauthenticated attackers can execute the malicious commands by making a single HTTP POST request to the vulnerable dns.php script, which triggers command execution and then deletes the file.
CWE类型:
CWE-78
标签:
（暂无数据）
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| SOUND4 Ltd. | Impact/Pulse/First | Version 2: 1.1/2.15 | - | - |
cpe:2.3:a:sound4_ltd.:impact_pulse_first:version_2:_1.1_2.15:*:*:*:*:*:*:*
|
| SOUND4 Ltd. | Impact/Pulse Eco | 1.16 | - | - |
cpe:2.3:a:sound4_ltd.:impact_pulse_eco:1.16:*:*:*:*:*:*:*
|
| SOUND4 Ltd. | BigVoice4 | 1.2 | - | - |
cpe:2.3:a:sound4_ltd.:bigvoice4:1.2:*:*:*:*:*:*:*
|
| SOUND4 Ltd. | BigVoice2 | 1.30 | - | - |
cpe:2.3:a:sound4_ltd.:bigvoice2:1.30:*:*:*:*:*:*:*
|
| SOUND4 Ltd. | Stream | 1.1/2.4.29 | - | - |
cpe:2.3:a:sound4_ltd.:stream:1.1_2.4.29:*:*:*:*:*:*:*
|
| Kantar Media | WM2 | 1.11 | - | - |
cpe:2.3:a:kantar_media:wm2:1.11:*:*:*:*:*:*:*
|
| sound4 | impact_firmware | 2.15 | - | - |
cpe:2.3:o:sound4:impact_firmware:2.15:*:*:*:*:*:*:*
|
| sound4 | impact_firmware | 1.69 | - | - |
cpe:2.3:o:sound4:impact_firmware:1.69:*:*:*:*:*:*:*
|
| sound4 | pulse_firmware | 2.15 | - | - |
cpe:2.3:o:sound4:pulse_firmware:2.15:*:*:*:*:*:*:*
|
| sound4 | pulse_firmware | 1.69 | - | - |
cpe:2.3:o:sound4:pulse_firmware:1.69:*:*:*:*:*:*:*
|
| sound4 | first_firmware | 2.15 | - | - |
cpe:2.3:o:sound4:first_firmware:2.15:*:*:*:*:*:*:*
|
| sound4 | first_firmware | 1.69 | - | - |
cpe:2.3:o:sound4:first_firmware:1.69:*:*:*:*:*:*:*
|
| sound4 | impact_eco_firmware | 1.16 | - | - |
cpe:2.3:o:sound4:impact_eco_firmware:1.16:*:*:*:*:*:*:*
|
| sound4 | pulse_eco_firmware | 1.16 | - | - |
cpe:2.3:o:sound4:pulse_eco_firmware:1.16:*:*:*:*:*:*:*
|
| sound4 | big_voice4_firmware | 1.2 | - | - |
cpe:2.3:o:sound4:big_voice4_firmware:1.2:*:*:*:*:*:*:*
|
| sound4 | big_voice2_firmware | 1.30 | - | - |
cpe:2.3:o:sound4:big_voice2_firmware:1.30:*:*:*:*:*:*:*
|
| sound4 | wm2_firmware | 1.11 | - | - |
cpe:2.3:o:sound4:wm2_firmware:1.11:*:*:*:*:*:*:*
|
| sound4 | stream_extension | 2.4.29 | - | - |
cpe:2.3:a:sound4:stream_extension:2.4.29:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
Zero Science Lab Disclosure (ZSL-2022-5733)
third-party-advisory
cve.org
访问
cve.org
Packet Storm Security Exploit Details
exploit
cve.org
访问
cve.org
IBM X-Force Vulnerability Exchange Entry
vdb-entry
cve.org
访问
cve.org
SOUND4 Product Homepage
product
cve.org
访问
cve.org
VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via dns.php
third-party-advisory
cve.org
访问
cve.org
CVSS评分详情
4.0 (cna)
HIGH
8.5
CVSS向量:
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
机密性
HIGH
完整性
HIGH
可用性
HIGH
后续系统影响 (Subsequent):
机密性
NONE
完整性
NONE
可用性
NONE
3.1 (cna)
HIGH
8.4
CVSS向量:
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
机密性
HIGH
完整性
HIGH
可用性
HIGH
时间信息
发布时间:
2025-12-30 22:41:36
修改时间:
2026-01-05 19:41:05
创建时间:
2026-01-12 02:08:39
更新时间:
2026-01-17 06:00:13
利用信息
暂无可利用代码信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2022-50789 |
2026-01-07 02:47:02 | 2026-01-12 02:08:39 |
| NVD | nvd_CVE-2022-50789 |
2026-01-01 04:27:49 | 2026-01-12 02:26:45 |
版本与语言
当前版本:
v3
主要语言:
EN
支持语言:
EN
安全公告
暂无安全公告信息
变更历史
v3
NVD
2026-01-14 06:14:30
affected_products_count: 6 → 18
查看详细变更
- affected_products_count: 6 -> 18
v2
NVD
2026-01-12 02:26:45
data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']