VULNERABILITY INTELLIGENCE

CVE-2023-53963

CVSS score9.8 CRITICAL

EPSS probability3.40%

CISA KEVNot currently listed

Published2025-12-22

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands through the 'password' parameter. Attackers can exploit the login.php and index.php scripts by injecting shell commands via the 'password' POST parameter to execute commands with web server privileges.

Weakness classification

disclosure@vulncheck.com: CWE-78

Primary references

disclosure@vulncheck.com — Product
disclosure@vulncheck.com — Exploit, Third Party Advisory, VDB Entry
disclosure@vulncheck.com — Third Party Advisory
disclosure@vulncheck.com — Exploit, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory