CVE-2023-53965

SOUND4 Server Service 4.1.102 Local Privilege Escalation via Unquoted Service Path

SOUND4 Server Service 4.1.102 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted binary path by inserting malicious code in the system root path that could execute with LocalSystem privileges during service startup.

Affected

SOUND4 Ltd. · SOUND4 Server Service

CVSS v4.0 VULNCHECK

8.6 HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 VULNCHECK

8.4 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.24% chance of exploitation in the next 30 days, 14th percentile

Published

2025-12-22

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/51167

Security advisories

• https://www.vulncheck.com/advisories/sound-server-service-local-privilege-escalation-via-…
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5721.php
• https://web.archive.org/web/20221207074555/https://www.sound4.com

References

• CVE Record
• NVD entry