CVE-2022-50796criticalCWE-22

CVE-2022-50796: falha crítica em Kantar Media WM2

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Remote Code Execution via upload.cgi

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar WM2+ Monitorar BigVoice2

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

48Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 9.3epss 1.6%
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an unauthenticated remote code execution vulnerability in the firmware upload functionality with path traversal flaw. Attackers can exploit the upload.cgi script to write malicious files to the system with www-data permissions, enabling unauthorized access and code execution.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Kantar Media · WM2SOUND4 Ltd. · BigVoice2SOUND4 Ltd. · BigVoice4SOUND4 Ltd. · Impact/Pulse EcoSOUND4 Ltd. · Impact/Pulse/FirstSOUND4 Ltd. · Stream
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Kantar Media WM2

No mesmo produto, das mais perigosas para as menos.

CVE-2022-50789HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via dns.phpEPSS 4.2%CVE-2022-50795HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via traceroute.phpEPSS 4.2%CVE-2022-50791HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via ping.phpEPSS 3.8%CVE-2022-50794CRITICALSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via UsernameEPSS 3.7%CVE-2023-53963CRITICALSOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Remote Command InjectionEPSS 3.4%CVE-2022-50793HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Authenticated Command Injection via www-data-handler.phpEPSS 3.1%