Security readout for executives and security teams
Plain-English summary
This flaw lets an unauthenticated person misuse certain SOUND4 and related web network tools to make the device send traffic at other hosts. The main business risk is service disruption, abuse of your infrastructure in a denial-of-service attack, and reputational or provider impact if devices are exposed online.
Executive priority
Treat as high priority if any affected appliance is reachable from the internet or untrusted networks. Prioritize exposure reduction and vendor guidance checks, because sources provide public exploit information but no confirmed patch details in the supplied bundle.
Technical view
CVE-2022-50695 affects listed SOUND4 IMPACT/PULSE/FIRST/Eco and related products. Diagnostic scripts including ping.php, traceroute.php, and dns.php can be abused without authentication to generate ICMP/network flooding toward arbitrary hosts. It is classified as CWE-770 with CVSS 4.0 score 8.7, driven by network reachability, no privileges, and high availability impact.
Likely exposure
Highest exposure is internet-reachable SOUND4 or Kantar Media WM2 appliances running the listed versions. Internal-only devices may still be abused by anyone with network access to the web interface. The source bundle does not identify a vendor patch or fixed version.
Exploitation context
Public exploit details are referenced by Packet Storm and third-party advisories, but the bundle does not show CISA KEV listing or confirmed active exploitation. Exploitation does not require credentials or user interaction, but practical impact depends on reachability and outbound traffic controls.
Researcher notes
The record describes availability impact through resource misuse rather than data theft or code execution. Affected-version notation in the bundle is uneven, so validate exact product builds carefully. Do not infer active exploitation from exploit publication alone; KEV is false in the provided data.
Mitigation direction
- Check SOUND4 or product vendor guidance for fixed versions or supported remediation.
- Remove internet exposure to affected device management or diagnostic interfaces.
- Restrict access to trusted administration networks only.
- Apply firewall and egress controls for unnecessary ICMP and diagnostic traffic.
- Monitor for unusual outbound traffic sourced from affected appliances.
- If supported, disable exposed diagnostic scripts or network command features.
Validation and detection
- Inventory SOUND4 and Kantar Media devices against affected product and version lists.
- Identify whether management or diagnostic web interfaces are internet-accessible.
- Review web logs for unauthenticated access to diagnostic script paths.
- Check network telemetry for unusual outbound ICMP or diagnostic traffic.
- Confirm firewall rules restrict access to trusted administrative sources.
- Track vendor advisories for patch or configuration guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-770: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50695 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- Zero Science Lab Disclosure (ZSL-2022-5728)CVE reference · third-party-advisory
- Packet Storm Security Exploit DetailsCVE reference · exploit
- IBM X-Force Vulnerability ExchangeCVE reference · vdb-entry
- SOUND4 Product HomepageCVE reference · product
- VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x ICMP Flood Attack via Network CommandsCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.