{"id":"CVE-2022-50696","aliases":["EUVD-2022-55940","GHSA-7fvm-m3gq-pf2p"],"status":"published","title":"SOUND4 IMPACT/FIRST/PULSE/Eco \u003c=2.x Hardcoded Credentials Authentication Bypass","description":"SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified through normal device operations. Attackers can leverage these static credentials to gain unauthorized access to the device across Linux and Windows distributions without requiring user interaction.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00596,"percentile":0.48756,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-798"],"published":"2025-12-30T22:41:35Z","modified":"2026-10-01T19:19:06Z","products":[{"vendor":"kantar media","product":"wm2"},{"vendor":"sound4","product":"big_voice2_firmware"},{"vendor":"sound4","product":"big_voice4_firmware"},{"vendor":"sound4","product":"first_firmware"},{"vendor":"sound4","product":"impact_eco_firmware"},{"vendor":"sound4","product":"impact_firmware"},{"vendor":"sound4","product":"pulse_eco_firmware"},{"vendor":"sound4","product":"pulse_firmware"},{"vendor":"sound4","product":"stream_extension"},{"vendor":"sound4","product":"wm2_firmware"},{"vendor":"sound4 ltd.","product":"bigvoice2"},{"vendor":"sound4 ltd.","product":"bigvoice4"},{"vendor":"sound4 ltd.","product":"impact/pulse eco"},{"vendor":"sound4 ltd.","product":"impact/pulse/first"},{"vendor":"sound4 ltd.","product":"stream"}],"references":[{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5729.php","tags":["third-party-advisory","Exploit","Third Party Advisory"]},{"url":"https://packetstormsecurity.com/files/170256/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Hardcoded-Credentials.html","tags":["exploit","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/247949","tags":["vdb-entry","Third Party Advisory"]},{"url":"https://www.sound4.com/","tags":["product","Product"]},{"url":"https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-hardcoded-credentials-authentication-bypass","tags":["third-party-advisory","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50696"},{"url":"https://www.sound4.com"},{"url":"https://github.com/advisories/GHSA-7fvm-m3gq-pf2p"}],"sources":{"cve":[{"id":"CVE-2022-50696","title":"SOUND4 IMPACT/FIRST/PULSE/Eco \u003c=2.x Hardcoded Credentials Authentication Bypass","description":"SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified through normal device operations. Attackers can leverage these static credentials to gain unauthorized access to the device across Linux and Windows distributions without requiring user interaction.","status":"published","published":"2025-12-30T22:41:35.214Z","modified":"2026-10-01T19:19:06.504Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:34:41.34666Z"}],"euvd":[{"id":"EUVD-2022-55940","description":"SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified through normal device operations. Attackers can leverage these static credentials to gain unauthorized access to the device across Linux and Windows distributions without requiring user interaction.","status":"published","published":"2025-12-30T22:41:35Z","modified":"2026-10-01T19:19:06Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T17:27:43.966642Z"}],"ghsa":[{"id":"GHSA-7fvm-m3gq-pf2p","title":"SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in...","description":"SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified through normal device operations. Attackers can leverage these static credentials to gain unauthorized access to the device across Linux and Windows distributions without requiring user interaction.","status":"published","published":"2025-12-31T00:31:10Z","modified":"2025-12-31T00:31:16Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T15:05:24.798125Z"}],"nvd":[{"id":"CVE-2022-50696","description":"SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified through normal device operations. Attackers can leverage these static credentials to gain unauthorized access to the device across Linux and Windows distributions without requiring user interaction.","status":"published","published":"2025-12-30T23:15:45.06Z","modified":"2026-06-17T05:24:01.287Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:07:43.46277Z"}]}}