CVE-2022-50696

Static authentication credentials (login and password) are embedded directly in the binary server files and cannot be changed during normal device operation. An attacker with knowledge of these credentials can log in to the device remotely over the network, completely bypassing access control mechanisms. The vulnerability affects both Linux and Windows environments, and exploitation does not require any user interaction or prior authentication.

An attacker can gain full unauthorized access to the device, which may lead to taking control of it, compromising the confidentiality and integrity of processed data, and potentially disrupting its operation.

Apply patches available from the manufacturer according to the references. It is also recommended to isolate SOUND4 devices on the network (e.g., place behind a firewall, restrict network access only to trusted hosts) until updates are implemented.

SOUND4 IMPACT, SOUND4 FIRST, SOUND4 PULSE, SOUND4 Eco — versions 2.x and lower (including firmware variants for Sound4 Pulse Eco, Sound4 Big Voice2, Sound4 Big Voice4)