CVE-2023-53965: SOUND4 Server Service 4.1.102 Local Privilege Escalation via Unquoted Service Path

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-12-22 · updated 2026-10-28
Weakness: CWE-428

Description

SOUND4 Server Service 4.1.102 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted binary path by inserting malicious code in the system root path that could execute with LocalSystem privileges during service startup.

Affected products

Sound4 Big Voice Firmware: 4.1.102 (and their updates)
Sound4 First Firmware: 4.1.102 (and their updates)
Sound4 Impact Eco Firmware: 4.1.102 (and their updates)
Sound4 Impact Firmware: 4.1.102 (and their updates)
Sound4 Ip Connect Firmware: 4.1.102 (and their updates)
Sound4 Playout Ula8 Firmware: 4.1.102 (and their updates)
Sound4 Pulse Eco Firmware: 4.1.102 (and their updates)
Sound4 Pulse Firmware: 4.1.102 (and their updates)
Sound4 Stream X2 Firmware: 4.1.102 (and their updates)
Sound4 Stream X4 Firmware: 4.1.102 (and their updates)
Sound4 Stream X8 Firmware: 4.1.102 (and their updates)
Sound4 Voice Ula2 Firmware: 4.1.102 (and their updates)
Sound4 Voice Ula4 Firmware: 4.1.102 (and their updates)
Sound4 Voice Ula8 Firmware: 4.1.102 (and their updates)
Sound4 Wm2 Firmware: 4.1.102 (and their updates)

References

Get alerted when CVE-2023-53965 or the next vulnerability affects your stack