CVE-2023-53963 - CVE House

Back to Database

Status published Critical CVE-2023-53963

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Remote Command Injection

9.3 CVSS

Vulnerability Description

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands through the 'password' parameter. Attackers can exploit the login.php and index.php scripts by injecting shell commands via the 'password' POST parameter to execute commands with web server privileges.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-53963

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

LiquidWorm as Gjoko Krstic of Zero Science Lab

References

More from SOUND4 Ltd.

View All →

SOUND4 LinkAndShare Transmitter 1.1.2 Format String Stack Buffer Overflow

SOUND4 Server Service 4.1.102 Local Privilege Escalation via Unquoted Service Path

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Factory Reset Vulnerability

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Directory Traversal File Write

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Cross-Site Request Forgery

Affected Vendor

SOUND4 Ltd.

View all reports →

Affected Software

Impact/Pulse/First, Impact/Pulse Eco, BigVoice4, BigVoice2, Stream, WM2

Vulnerable Versions:

Version 2: 1.1/2.15, 1.16, 1.2, 1.30, 1.1/2.4.29, 1.11

Timeline

Official Publish: December 22nd, 2025

Last Modified: December 22nd, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1005 Data from Local System

T1041 Exfiltration Over C2 Channel