CVE-2023-53955 | THREATINT

Description

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows attackers to bypass authorization and access hidden system resources. Attackers can exploit the vulnerability by manipulating user-supplied input to execute privileged functionalities without proper authentication.

PUBLISHED Reserved 2025-12-19 | Published 2025-12-22 | Updated 2025-12-22 | Assigner VulnCheck

CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

Authorization Bypass Through User-Controlled Key

Product status

Version 2: 1.1/2.15

affected

1.16

affected

1.2

affected

1.30

affected

1.1/2.4.29

affected

1.11

affected

Credits

LiquidWorm as Gjoko Krstic of Zero Science Lab finder

References

www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5723.php exploit

www.exploit-db.com/exploits/51169 (ExploitDB-51169) exploit

web.archive.org/web/20221207074555/https://www.sound4.com/ (SOUND4 Official Product Homepage) product

www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5723.php (Zero Science Lab Disclosure (ZSL-2022-5723)) third-party-advisory

www.vulncheck.com/...n-bypass-via-insecure-object-references (VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Authorization Bypass via Insecure Object References) third-party-advisory

cve.org (CVE-2023-53955)

nvd.nist.gov (CVE-2023-53955)

Download JSON