CVE-2022-50696

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Hardcoded Credentials Authentication Bypass

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified through normal device operations. Attackers can leverage these static credentials to gain unauthorized access to the device across Linux and Windows distributions without requiring user interaction.

Affected

SOUND4 Ltd. · Kantar Media · Impact/Pulse/First · Impact/Pulse Eco · BigVoice4 · BigVoice2 · Stream · WM2

CVSS v4.0 VULNCHECK

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.60% chance of exploitation in the next 30 days, 47th percentile

Published

2025-12-30

Updated

2026-10-01

Proof-of-concept exploits (1)

• https://packetstormsecurity.com/files/170256/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Hardcoded-…

Security advisories

• https://exchange.xforce.ibmcloud.com/vulnerabilities/247949
• https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-hardcoded-credentials-au…
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5729.php
• https://www.sound4.com

References

• CVE Record
• NVD entry