What’s Vulnerable › Vulnerabilities

CVE-2023-53955: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Authorization Bypass via Insecure Object References

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-22 · updated 2026-06-17
• Weakness: CWE-639

Description

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows attackers to bypass authorization and access hidden system resources. Attackers can exploit the vulnerability by manipulating user-supplied input to execute privileged functionalities without proper authentication.

Affected products

• Sound4 Big Voice2 Firmware: 1.30
• Sound4 Big Voice4 Firmware: 1.2
• Sound4 First Firmware: 1.69, 2.15
• Sound4 Impact Eco Firmware: 1.16
• Sound4 Impact Firmware: 1.69, 2.15
• Sound4 Pulse Eco Firmware: 1.16
• Sound4 Pulse Firmware: 1.69, 2.15
• Sound4 Stream Extension: 2.4.29
• Sound4 Wm2 Firmware: 1.11

References

• https://web.archive.org/web/20221207074555/https://www.sound4.com/
• https://www.exploit-db.com/exploits/51169
• https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-authorization-bypass-via-insecure-object-references
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5723.php
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5723.php

Get alerted when CVE-2023-53955 or the next vulnerability affects your stack