CVE-2023-53963

An attacker sends an HTTP POST request to the login.php or index.php scripts, injecting malicious shell commands into the 'password' parameter. The application does not properly validate input data before passing it to system calls, resulting in execution of injected commands with the privileges of the web server process. The attack is possible remotely over the network without requiring any access credentials.

An attacker can execute arbitrary system commands with the privileges of the web server, which in practice enables taking control of the device, reading or modifying configuration, and potentially using the device as a starting point for further actions on the network.

Patches available from the manufacturer should be applied according to the references. As an interim remedial action, it is recommended to isolate devices from public network access, place them behind a firewall, and restrict access to the management interface only to trusted IP addresses.

SOUND4 IMPACT, SOUND4 FIRST, SOUND4 PULSE, SOUND4 Pulse Eco, SOUND4 Big Voice2, SOUND4 Big Voice4 — firmware version v2.x