CVE-2022-50796

The vulnerability results from a combination of a path traversal error (CWE-22) and lack of authentication in the upload.cgi script responsible for firmware uploads. An attacker can send a specially crafted request to the upload.cgi script containing a path traversal sequence that allows writing malicious files anywhere in the filesystem accessible to the www-data process. Files written this way can contain executable code, which can then be executed on the device, leading to system compromise.

Attackers gain the ability to write malicious files to the device with www-data privileges and execute arbitrary remote code without any authorization, resulting in unauthorized system access and potential complete device takeover.

Apply patches available from the manufacturer according to the references. As a temporary measure, it is recommended to restrict network access to the administrative interface of SOUND4 devices exclusively to trusted networks or hosts and isolate these devices from the public internet using a firewall.

SOUND4 IMPACT, SOUND4 FIRST, SOUND4 PULSE, SOUND4 Pulse Eco, SOUND4 Big Voice2, SOUND4 Big Voice4 — in firmware versions 2.x and earlier