CVE-2022-50795 SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via traceroute.php

🗓️ 30 Dec 2025 22:41:39Reported by VulnCheckType

CVE-2022-50795: Unauthenticated POST to traceroute.php triggers command injection and creates a temporary file in /tmp, with local authenticated users able to create malicious files.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2022-50795	31 Dec 202521:03	–	circl
CNNVD	SOUND4多款产品操作系统命令注入漏洞	30 Dec 202500:00	–	cnnvd
CVE	CVE-2022-50795	30 Dec 202522:41	–	cve
EUVD	EUVD-2022-55931	31 Dec 202500:31	–	euvd
NVD	CVE-2022-50795	30 Dec 202523:15	–	nvd
OSV	CVE-2022-50795	30 Dec 202523:15	–	osv
Positive Technologies	PT-2025-54243	30 Dec 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2022-50795: Improper Neutralization of Special Elements used in an OS Command	30 Dec 202500:00	–	rapid7
Vulnrichment	CVE-2022-50795 SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via traceroute.php	30 Dec 202522:41	–	vulnrichment
Zero Science Lab	SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x (traceroute.php) Conditional Command Injection	14 Dec 202200:00	–	zeroscience

[
  {
    "vendor": "SOUND4 Ltd.",
    "product": "Impact/Pulse/First",
    "versions": [
      {
        "version": "Version 2: 1.1/2.15",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "SOUND4 Ltd.",
    "product": "Impact/Pulse Eco",
    "versions": [
      {
        "version": "1.16",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "SOUND4 Ltd.",
    "product": "BigVoice4",
    "versions": [
      {
        "version": "1.2",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "SOUND4 Ltd.",
    "product": "BigVoice2",
    "versions": [
      {
        "version": "1.30",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "SOUND4 Ltd.",
    "product": "Stream",
    "versions": [
      {
        "version": "1.1/2.4.29",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Kantar Media",
    "product": "WM2",
    "versions": [
      {
        "version": "1.11",
        "status": "affected"
      }
    ]
  }
]

Source	Link
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/247950
vulncheck	www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-conditional-command-injection-via-traceroutephp
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5740.php
sound4	www.sound4.com/
packetstormsecurity	www.packetstormsecurity.com/files/170267/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-traceroute.php-Conditional-Command-Injection.html

16 Jan 2026 19:00Current

CVSS 3.17.8

CVSS 48.5

EPSS0.04219

CWE-78