CVE-2022-50692 | THREATINT

Description

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an insufficient session expiration vulnerability that allows attackers to reuse old session credentials. Attackers can exploit weak session management to potentially hijack active user sessions and gain unauthorized access to the application.

PUBLISHED Reserved 2025-12-21 | Published 2025-12-30 | Updated 2025-12-30 | Assigner VulnCheck

MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem types

Insufficient Session Expiration

Product status

Version 2: 1.1/2.15

affected

1.16

affected

1.2

affected

1.30

affected

1.1/2.4.29

affected

1.11

affected

Credits

LiquidWorm as Gjoko Krstic of Zero Science Lab finder

References

www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5724.php (Zero Science Lab Disclosure (ZSL-2022-5724)) third-party-advisory

packetstormsecurity.com/...ufficient-Session-Expiration.html (Packet Storm Security Exploit Entry) exploit

cxsecurity.com/issue/WLB-2022120030 (CXSecurity Vulnerability Listing) third-party-advisory

exchange.xforce.ibmcloud.com/vulnerabilities/247956 (IBM X-Force Vulnerability Exchange) vdb-entry

www.sound4.com/ (SOUND4 Product Homepage) product

www.vulncheck.com/...icient-session-expiration-vulnerability (VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Insufficient Session Expiration Vulnerability) third-party-advisory

cve.org (CVE-2022-50692)

nvd.nist.gov (CVE-2022-50692)

Download JSON