CVE-2023-53962

🗓️ 22 Dec 2025 21:37:16Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 41 Views🌐 WEB

Unauthenticated directory traversal in SOUND4 devices v2.x enables remote file writes via upgfile.

Reporter	Title	Published	Views	Family All 9
CNNVD	Sound4 IMPACT path traversal vulnerability	22 Dec 202500:00	–	cnnvd
Cvelist	CVE-2023-53962 SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Directory Traversal File Write	22 Dec 202521:37	–	cvelist
EUVD	EUVD-2023-60247	23 Dec 202500:30	–	euvd
NVD	CVE-2023-53962	22 Dec 202522:16	–	nvd
osv_cve	CVE-2023-53962	22 Dec 202522:16	–	osv_cve
Positive Technologies	PT-2025-52699	22 Dec 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2023-53962: Improper Limitation of a Pathname to a Restricted Directory	22 Dec 202500:00	–	rapid7
Vulnrichment	CVE-2023-53962 SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Directory Traversal File Write	22 Dec 202521:37	–	vulnrichment
Zero Science Lab	SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Directory Traversal File Write Exploit	14 Dec 202200:00	–	zeroscience

NVD

Vulners

CNA

Node

AND

sound4 impact_firmwareMatch2.15

sound4 impactMatch2.0

Node

AND

sound4 impact_firmwareMatch1.69

sound4 impactMatch1.0

Node

AND

sound4 pulse_firmwareMatch2.15

sound4 pulseMatch2.0

Node

AND

sound4 pulse_firmwareMatch1.69

sound4 pulseMatch1.0

Node

AND

sound4 first_firmwareMatch2.15

sound4 firstMatch2.0

Node

AND

sound4 first_firmwareMatch1.69

sound4 firstMatch1.0

Node

sound4 stream_extensionMatch2.4.29

Node

AND

sound4 wm2_firmwareMatch1.11

sound4 wm2Match-

Node

AND

sound4 big_voice2_firmwareMatch1.30

sound4 big_voice2Match-

Node

AND

sound4 big_voice4_firmwareMatch1.2

sound4 big_voice4Match-

Node

AND

sound4 pulse_eco_firmwareMatch1.16

sound4 pulse_ecoMatch-

Node

AND

sound4 impact_eco_firmwareMatch1.16

sound4 impact_ecoMatch-

[
  {
    "vendor": "SOUND4 Ltd.",
    "product": "Impact/Pulse/First",
    "versions": [
      {
        "version": "Version 2: 1.1/2.15",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "SOUND4 Ltd.",
    "product": "Impact/Pulse Eco",
    "versions": [
      {
        "version": "1.16",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "SOUND4 Ltd.",
    "product": "BigVoice4",
    "versions": [
      {
        "version": "1.2",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "SOUND4 Ltd.",
    "product": "BigVoice2",
    "versions": [
      {
        "version": "1.30",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "SOUND4 Ltd.",
    "product": "Stream",
    "versions": [
      {
        "version": "1.1/2.4.29",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Kantar Media",
    "product": "WM2",
    "versions": [
      {
        "version": "1.11",
        "status": "affected"
      }
    ]
  }
]

Source	Link
web	www.web.archive.org/web/20221207074555/https://www.sound4.com/
exploit-db	www.exploit-db.com/exploits/51172
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5730.php
vulncheck	www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-directory-traversal-file-write

Parameter	Position	Path	Description	CWE
upgfile	request body	/cgi-bin/upload.cgi	Unauthenticated directory traversal file write vulnerability via the 'upgfile' parameter in a multipart form-data POST request.	CWE-22
filename	request body	/upgrade.php	Unauthenticated directory traversal file write vulnerability via the 'filename' POST parameter used for uploading .upgbox Firmware files.	CWE-22

01 Oct 2026 19:19Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.17.5

CVSS 48.8

EPSS0.01238

SSVC

CWE-22