---
id: CVE-2022-50795
title: >-
  SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via
  traceroute.php
summary: >-
  SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection
  vulnerability that allows local authenticated users to create malicious files
  in the /tmp directory. Unauthenticated attackers can execute commands by
  making a …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-78
vendor: SOUND4 Ltd.
product: Impact/Pulse/First
affected:
  - 'Impact/Pulse/First Version 2: 1.1/2.15'
  - impact_pulse_eco 1.16
  - BigVoice4 1.2
  - BigVoice2 1.30
  - Stream 1.1/2.4.29
  - WM2 1.11
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-01-05T20:22:03.980717Z'
exploitAvailable: true
published: '2025-12-30'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T19:19:12.365Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-50795'
references:
  - url: 'https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5740.php'
    label: Zero Science Lab Disclosure (ZSL-2022-5740)
  - url: >-
      https://packetstormsecurity.com/files/170267/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-traceroute.php-Conditional-Command-Injection.html
    label: Packet Storm Security Exploit Details
  - url: 'https://exchange.xforce.ibmcloud.com/vulnerabilities/247950'
    label: IBM X-Force Vulnerability Exchange Entry
  - url: 'https://www.sound4.com/'
    label: SOUND4 Product Homepage
  - url: >-
      https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-conditional-command-injection-via-traceroutephp
    label: >-
      VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional
      Command Injection via traceroute.php
tags:
  - cve.org
  - exploit-available
epss: 0.04162
epssPercentile: 0.90564
ingestedAt: '2026-10-01T19:58:57.578Z'
---

## Overview

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory. Unauthenticated attackers can execute commands by making a single HTTP POST request to the traceroute.php script, which triggers the malicious file and then deletes it after execution.

## Affected

- `Impact/Pulse/First Version 2: 1.1/2.15`
- `impact_pulse_eco 1.16`
- `BigVoice4 1.2`
- `BigVoice2 1.30`
- `Stream 1.1/2.4.29`
- `WM2 1.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.