Sound4 develops a compact line of embedded audio and impact-measurement devices, with vulnerabilities concentrating across its First and Impact product families and their associated firmware. The disclosures skew strongly toward critical-severity outcomes and recur through weakness classes that reflect inadequate input handling and authentication enforcement in networked embedded systems: OS command injection, SQL injection, path traversal, and missing authentication for critical functions, alongside failures to validate downloaded code integrity. These patterns suggest that the vendor's devices may be exposed to unauthenticated remote attack vectors and supply-chain integrity risks, making them attractive targets despite their niche deployment footprint. Defenders using Sound4 devices should prioritize firmware updates and restrict network access to management interfaces; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Sound4 over time
Signals from CVEs in this vendor scope (25 CVEs).
25 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-53963CRITICAL SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands through the 'pass | Dec 22, 2025 | 9.8 | 36 | NO | NO |
CVE-2023-53966CRITICAL SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory stack overflows through maliciously crafted environment variabl | Dec 22, 2025 | 9.8 | 34 | NO | NO |
CVE-2023-53964CRITICAL SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated vulnerability in the /usr/cgi-bin/restorefactory.cgi endpoint that allows remote attackers to reset device configurat | Dec 22, 2025 | 9.8 | 34 | NO | NO |
CVE-2023-53960CRITICAL SOUND4 IMPACT/FIRST/PULSE/Eco version 2.x contains an SQL injection vulnerability in the 'index.php' authentication mechanism that allows attackers to manipulate login credentials. | Dec 22, 2025 | 9.8 | 34 | NO | NO |
CVE-2022-50794CRITICAL SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploit index.php and login | Dec 30, 2025 | 9.8 | 31 | NO | NO |
CVE-2023-53955CRITICAL SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows attackers to bypass authorization and access hidden system resources. Atta | Dec 22, 2025 | 9.8 | 31 | NO | NO |
CVE-2022-50796CRITICAL SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an unauthenticated remote code execution vulnerability in the firmware upload functionality with path traversal flaw. Attackers can exp | Dec 30, 2025 | 9.8 | 30 | NO | NO |
CVE-2022-50696CRITICAL SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified through normal device operations. Attackers c | Dec 30, 2025 | 9.8 | 30 | NO | NO |
CVE-2022-50694CRITICAL SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an SQL injection vulnerability in the 'username' POST parameter of index.php that allows attackers to manipulate database queries. Atta | Dec 30, 2025 | 9.8 | 30 | NO | NO |
CVE-2025-57431HIGH The Sound4 PULSE-ECO AES67 1.22 web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package. The update mechanism fails to v | Sep 22, 2025 | 8.8 | 27 | NO | NO |
Signals from CVEs in this vendor scope (25 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Sound4.
Media articles that mention a CVE ID that affects a product developed by Sound4 — matched by CVE ID, not by vendor name.