CVE-2022-50792
📋 TL;DR
This vulnerability allows remote attackers to read arbitrary files on SOUND4 IMPACT/FIRST/PULSE/Eco devices without authentication by manipulating the 'file' GET parameter. Attackers can access sensitive system files including configuration files, passwords, and other critical data. All users running affected versions are vulnerable.
💻 Affected Systems
- SOUND4 IMPACT
- SOUND4 FIRST
- SOUND4 PULSE
- SOUND4 Eco
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through disclosure of credentials, configuration files, and sensitive data leading to further attacks on the network.
Likely Case
Disclosure of sensitive configuration files, passwords, and system information that could enable lateral movement or additional attacks.
If Mitigated
Limited impact if devices are behind firewalls with strict network segmentation and access controls.
🎯 Exploit Status
Exploitation requires only HTTP requests with manipulated parameters. Public proof-of-concept code exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sound4.com/
Restart Required: No
Instructions:
Contact SOUND4 vendor for updated firmware. Check vendor website for security advisories and patches.
🔧 Temporary Workarounds
Network Access Control
allRestrict network access to SOUND4 devices using firewalls or network segmentation
Web Application Firewall
allDeploy WAF rules to block requests containing directory traversal patterns
🧯 If You Can't Patch
- Isolate affected devices in separate network segments with strict firewall rules
- Implement network monitoring for suspicious file access patterns to affected devices
🔍 How to Verify
Check if Vulnerable:
Test by sending HTTP GET request with file parameter containing path traversal (e.g., GET /endpoint?file=../../etc/passwd)Check Version:
Check device web interface or console for firmware version informationVerify Fix Applied:
Attempt exploitation after applying vendor patches or workarounds to confirm vulnerability is mitigated📡 Detection & Monitoring
Log Indicators:
- HTTP requests with 'file' parameter containing '../' patterns
- Unusual file access patterns from external IPs
Network Indicators:
- HTTP GET requests with path traversal sequences in parameters
- Multiple failed file access attempts
SIEM Query:
source="web_logs" AND (uri_query="*file=*../*" OR uri_query="*file=*..%2f*")🔗 References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/247916
- https://packetstormsecurity.com/files/170263/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Unauthenticated-File-Disclosure.html
- https://www.sound4.com/
- https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-file-disclosure-vulnerability
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5736.php
