SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via traceroute.php
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory. Unauthenticated attackers can execute commands by making a single HTTP POST request to the traceroute.php script, which triggers the malicious file and then deletes it after execution.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Impact/Pulse/First
Vendor
SOUND4 Ltd.
Product
Impact/Pulse/First
Platforms
Unknown
Default status
Unknown
Impact/Pulse/First · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
Version 2: 1.1/2.15
affected
Unavailable
Unavailable
Unavailable
None listed
Impact/Pulse Eco
Vendor
SOUND4 Ltd.
Product
Impact/Pulse Eco
Platforms
Unknown
Default status
Unknown
Impact/Pulse Eco · Scoped product and version facts