---
id: CVE-2022-50790
title: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Radio Stream Disclosure
summary: >-
  SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an
  unauthenticated vulnerability that allows remote attackers to access live
  radio stream information through webplay or ffmpeg scripts. Attackers can
  exploit the vulnerability…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-306
vendor: SOUND4 Ltd.
product: Impact/Pulse/First
affected:
  - 'Impact/Pulse/First Version 2: 1.1/2.15'
  - impact_pulse_eco 1.16
  - BigVoice4 1.2
  - BigVoice2 1.30
  - Stream 1.1/2.4.29
  - WM2 1.11
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-03-04T19:27:34.733369Z'
exploitAvailable: true
published: '2025-12-30'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T19:19:09.077Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-50790'
references:
  - url: 'https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5734.php'
    label: Zero Science Lab Disclosure (ZSL-2022-5734)
  - url: >-
      https://packetstormsecurity.com/files/170261/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Radio-Steam-Disclosure.html
    label: Packet Storm Security Exploit Details
  - url: 'https://exchange.xforce.ibmcloud.com/vulnerabilities/247923'
    label: IBM X-Force Vulnerability Exchange Entry
  - url: 'https://www.sound4.com/'
    label: SOUND4 Product Homepage
  - url: >-
      https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-radio-stream-disclosure
    label: >-
      VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated
      Radio Stream Disclosure
tags:
  - cve.org
  - exploit-available
epss: 0.0079
epssPercentile: 0.54624
ingestedAt: '2026-10-01T19:58:57.580Z'
---

## Overview

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated vulnerability that allows remote attackers to access live radio stream information through webplay or ffmpeg scripts. Attackers can exploit the vulnerability by calling specific web scripts to disclose radio stream details without requiring authentication.

## Affected

- `Impact/Pulse/First Version 2: 1.1/2.15`
- `impact_pulse_eco 1.16`
- `BigVoice4 1.2`
- `BigVoice2 1.30`
- `Stream 1.1/2.4.29`
- `WM2 1.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.