CVE-2023-53955

The vulnerability (CWE-639) consists in the application not properly verifying user permissions when accessing internal system objects. An attacker can manipulate user-supplied data (e.g., request parameters) in such a way as to directly reference protected resources or functions. The lack of proper access control on the server side enables the execution of privileged operations without valid authentication.

A remote unauthenticated attacker can gain unauthorized access to hidden system resources and execute privileged functions on the device, leading to violations of system confidentiality, integrity, and availability.

Apply patches available from the manufacturer according to the references. As a temporary measure, it is recommended to restrict network access to SOUND4 device management interfaces through a firewall or network segmentation, so they are accessible only from trusted hosts.

SOUND4 IMPACT, SOUND4 FIRST, SOUND4 PULSE, SOUND4 Pulse Eco, SOUND4 Big Voice2, SOUND4 Big Voice4 — all in firmware version v2.x