CVE-2023-53962
HIGH
MEDIUM
Priority: 0.11
BB Relevance:
78/100
Published: 2025-12-22
Modified: 2026-11-10
First seen: 2026-11-10
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
X
AT:
None
VC:
Low
VI:
High
VA:
Low
Description
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated directory traversal vulnerability that allows remote attackers to write arbitrary files through the 'upgfile' parameter in upload.cgi. Attackers can exploit the vulnerability by sending crafted multipart form-data POST requests with directory traversal sequences to write files to unintended system locations.
Weakness Classification (1)
Affected Software (12)
| Vendor | Product | Version |
|---|---|---|
| sound4 | big_voice2_firmware | 1.30 |
| sound4 | big_voice4_firmware | 1.2 |
| sound4 | first_firmware | 2.15 |
| sound4 | first_firmware | 1.69 |
| sound4 | impact_eco_firmware | 1.16 |
| sound4 | impact_firmware | 2.15 |
| sound4 | impact_firmware | 1.69 |
| sound4 | pulse_eco_firmware | 1.16 |
| sound4 | pulse_firmware | 2.15 |
| sound4 | pulse_firmware | 1.69 |
| sound4 | stream_extension | 2.4.29 |
| sound4 | wm2_firmware | 1.11 |
References & Advisories (4)
Third Party Advisory
Product
Exploit
Third Party Advisory
VDB Entry
Exploit
Third Party Advisory