SOUND4 Impact/Pulse/First Hardcoded Credentials Vulnerability (ZSL-2022-5729)

Key Information Title: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x (sound4server) Hardcoded Credentials Advisory ID: ZSL-2022-5729 Type: Local/Remote Impact: Privilege Escalation, System Access, Denial of Service Risk: 4/5 Release Date: 14.12.2022 Summary: Describes the features and characteristics of SOUND4 products, emphasizing their advantages in audio processing and compatibility with broadcasting standards. Description: The server binary included in Linux and Windows distributions contains hardcoded credentials. These credentials are not exposed to end users and cannot be changed through normal operations. Modifying the credentials requires the use of the SOUND4 Remote Control thick client. Technical Details Vendor: SOUND4 Ltd. Affected Versions: - FM/HD Radio Processing: Impact/Pulse/First versions 2: 1.1/2.15, etc. - Voice Processing: BigVoice1/2 versions, etc. - Web-Audio Streaming: Stream versions, etc. - Watermarking: WM2 (Kantar Media) 1.11 Test Environment Tested using Apache/2.4.25, OpenSSL, PHP, etc., on multiple operating systems. Vendor Status Vulnerability discovered on 26.09.2022, vendor contacted on 30.09.2022. No response received by 13.12.2022, leading to the public release of the security advisory. Additional Information PoC: sound4_hardcoded.txt Discoverer: Gjoko Krstic References: Links to related vulnerability information provided Update History: Detailed record of advisory release and modification timestamps. Contact: Website and email information for Zero Science Lab.

Goal Reached Thanks to every supporter — we hit 100%!

SOUND4 Impact/Pulse/First Hardcoded Credentials Vulnerability (ZSL-2022-5729)