Security readout for executives and security teams
Plain-English summary
This vulnerability can expose sensitive log files from affected SOUND4 and related systems without requiring login. For organizations using these products in broadcast or media workflows, exposed logs may reveal system details useful for follow-on attacks. Treat internet-facing deployments as the highest concern.
Executive priority
Prioritize remediation for internet-facing or third-party-accessible systems. The business risk is unauthorized disclosure of operational and system data, which can support later compromise. Internal-only systems are lower urgency but should still be validated.
Technical view
CVE-2022-50788 is a CWE-548 information disclosure issue. Affected SOUND4 IMPACT, FIRST, PULSE, Eco and listed related products allow unauthenticated browsing of the /log directory, exposing sensitive system log data. CVSS is 7.5, driven by network reachability, no authentication, and high confidentiality impact.
Likely exposure
Exposure is most likely where affected devices or web interfaces are reachable from the internet or broad internal networks. The bundle lists several affected product/version combinations, but does not provide CPEs or deployment prevalence.
Exploitation context
Public exploit details are referenced by Packet Storm, but the provided sources do not show CISA KEV listing or confirmed active exploitation. The issue appears easy to check because it requires no authentication and targets a predictable log directory.
Researcher notes
The provided bundle identifies CWE-548 and CVSS 7.5. Affected entries include SOUND4 Impact/Pulse/First, Impact/Pulse Eco, BigVoice4, BigVoice2, Stream, and Kantar Media WM2. No official patch version is included in the supplied sources.
Mitigation direction
- Identify affected SOUND4, Kantar WM2, BigVoice, and Stream deployments and versions.
- Restrict management or web access to trusted networks only.
- Prevent unauthenticated access to log directories using web server or appliance controls.
- Avoid exposing affected interfaces directly to the internet.
- Check vendor guidance for fixed versions or official remediation.
Validation and detection
- Inventory products and versions against the affected list in the CVE bundle.
- From an authorized test location, verify whether /log is reachable without authentication.
- Review exposed logs for sensitive host, network, credential, or operational data.
- Confirm access controls block unauthenticated log directory browsing.
- Document compensating controls where vendor fixes are unavailable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-548: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50788 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- Zero Science Lab Disclosure (ZSL-2022-5732)CVE reference · third-party-advisory
- Packet Storm Security Exploit DetailsCVE reference · exploit
- IBM X-Force Vulnerability Exchange EntryCVE reference · vdb-entry
- SOUND4 Product HomepageCVE reference · product
- VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Information Disclosure via Log DirectoryCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Information Through Directory Listing
Exposure of Information Through Directory Listing represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.