SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Information Disclosure via Log Directory

Advisories

severity: medium
date: December 30, 2025
Affecting: Impact/Pulse/First Version 2: 1.1/2.15
Impact/Pulse Eco 1.16
BigVoice4 1.2
BigVoice2 1.30
Stream 1.1/2.4.29
WM2 1.11
CVE: CVE-2022-50788
CWE: CWE-548 Exposure of Information Through Directory Listing
CVSS: 6.9
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References: Zero Science Lab Disclosure (ZSL-2022-5732)
Packet Storm Security Exploit Details
IBM X-Force Vulnerability Exchange Entry
SOUND4 Product Homepage
Credit: LiquidWorm as Gjoko Krstic of Zero Science Lab
Description: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive log files. Attackers can directly browse the /log directory to retrieve system and sensitive information without authentication.