Old CVEs, Live Airwaves at Risk: Why Legacy SOUND4 Flaws Still Enable Full Remote Takeover Today

Affected Vendor & Products

SOUND4
Products: IMPACT / FIRST / PULSE / Eco
Affected Versions: 2.x and below
Deployment Type: Broadcast, radio, media streaming, embedded Linux appliances

Executive Risk Summary

SOUND4 IMPACT/FIRST/PULSE/Eco devices running firmware 2.x and below contain multiple critical and high-severity vulnerabilities that collectively allow:

Unauthenticated remote code execution
Authentication bypass
Arbitrary file read and write
Command injection
Hardcoded credential abuse
Persistent device compromise
Network abuse and amplification attacks

Any exposed SOUND4 system should be considered at high risk of full compromise.

Severity Overview

CVE	Severity	Core Impact
CVE-2022-50796	Critical	Unauthenticated RCE via firmware upload
CVE-2022-50794	Critical	Unauthenticated command injection
CVE-2022-50696	Critical	Hardcoded credentials
CVE-2022-50795	High	Conditional RCE via traceroute
CVE-2022-50793	High	Authenticated command injection
CVE-2022-50792	High	Arbitrary file disclosure
CVE-2022-50791	High	Conditional RCE via ping
CVE-2022-50789	High	Conditional RCE via DNS
CVE-2022-50695	High	Network abuse / flooding
CVE-2022-50694	High	SQL injection
CVE-2022-50790	Medium	Stream information disclosure
CVE-2022-50788	Medium	Log file disclosure
CVE-2022-50787	Medium	Stored XSS
CVE-2022-50692	Medium	Session hijacking

Key Vulnerability Classes Explained

Unauthenticated Remote Code Execution (RCE)

CVE-2022-50796 & CVE-2022-50794

Firmware upload (upload.cgi) allows path traversal
Attackers can write arbitrary files with www-data permissions
Username parameter in index.php / login.php is directly passed to shell
No authentication required

Impact:
Full system compromise
Persistent backdoors
Broadcast manipulation

Conditional Command Injection via System Tools

CVE-2022-50795 / 50791 / 50789

These vulnerabilities follow the same dangerous pattern:

A local authenticated user creates a malicious file in /tmp
An unauthenticated attacker triggers execution via:
- ping.php
- traceroute.php
- dns.php
File executes commands, then deletes itself

Impact:
One-shot remote command execution
Difficult forensic tracing

Hardcoded Credentials (Critical)

CVE-2022-50696

Static credentials embedded in server binaries
Cannot be changed through UI or configuration
Works across Linux and Windows deployments

Impact:
Guaranteed unauthorized access
Vendor backdoor-like behavior

File & Information Disclosure

CVE-2022-50792 / 50788 / 50790

Attackers can:

Read arbitrary system files via file GET parameter
Browse /log directory without authentication
Access live radio stream configuration via webplay / ffmpeg

Impact:
Credential leakage
System mapping
Broadcast intelligence gathering

🗄️ SQL Injection & Session Abuse

CVE-2022-50694 / 50692

SQL injection via username POST parameter
Weak session expiration allows reuse of old session tokens

Impact:
Authentication bypass
Account takeover

Chained Attack Scenario (Worst Case)

Attacker logs in using hardcoded credentials
Uploads malicious firmware or writes shell via upload.cgi
Gains persistent RCE
Reads configuration, logs, credentials
Manipulates or disrupts broadcast streams
Uses device for network flooding or lateral movement

Result: Silent, long-term compromise of broadcast infrastructure

MITRE ATT&CK Mapping

Initial Access

T1190 – Exploit Public-Facing Application
T1078 – Valid Accounts

Execution

T1059 – Command and Scripting Interpreter

Persistence

T1505 – Server-Side Backdoor
T1542 – Firmware Compromise

Credential Access

T1552 – Unsecured Credentials

Discovery

T1083 – File and Directory Discovery

Impact

T1499 – Denial of Service
T1565 – Data Manipulation

Detection & Monitoring

Indicators of Compromise

Unexpected files in /tmp
Web requests invoking:
- ping.php
- dns.php
- traceroute.php
- upload.cgi
Firmware updates outside maintenance windows
Unusual outbound ICMP traffic

Relevant Log Sources

Web server access logs
Firmware update logs
System process execution logs
Network monitoring / IDS logs

Mitigation & Remediation

Immediate Actions

Disconnect affected systems from the internet
Block access to management interfaces
Monitor for unauthorized firmware changes
Audit /tmp, /www, and binary directories

Permanent Fix

Apply vendor firmware updates and security patches from the official source:

Official Updates:
https://www.sound4.com

Final Assessment

This is not a single vulnerability issue — it is a systemic security failure.
SOUND4 devices running firmware 2.x or below expose broadcast infrastructure to full remote takeover with minimal effort.

If these systems are internet-facing, compromise should be assumed until proven otherwise.