CVE-2022-50695

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x ICMP Flood Attack via Network Commands

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x contains a network vulnerability that allows unauthenticated attackers to send ICMP signals to arbitrary hosts through network command scripts. Attackers can abuse ping.php, traceroute.php, and dns.php to generate network flooding attacks targeting external hosts.

Affected

SOUND4 Ltd. · Kantar Media · Impact/Pulse/First · Impact/Pulse Eco · BigVoice4 · BigVoice2 · Stream · WM2

CVSS v4.0 VULNCHECK

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.80% chance of exploitation in the next 30 days, 56th percentile

Published

2025-12-30

Updated

2026-10-01

Proof-of-concept exploits (1)

• https://packetstormsecurity.com/files/170255/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-ICMP-Flood…

Security advisories

• https://exchange.xforce.ibmcloud.com/vulnerabilities/247948
• https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-icmp-flood-attack-via-ne…
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5728.php
• https://www.sound4.com

References

• CVE Record
• NVD entry