VulnerabilityAnalyzed

CVE-2025-63215

The Sound4 IMPACT web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package.

HIGH 7.2EPSS 0.46%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.46%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The Sound4 IMPACT web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package. The update mechanism fails to validate the integrity of manual.sh, allowing an attacker to inject arbitrary commands by modifying this script and repackaging the firmware.

CVSS 3.1: 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.46% probability · 39th percentile
CISA KEV: Not listed
Weakness: CWE-494
Affected: sound4/impact firmware
Source: cve@mitre.org

References

https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63215%20_%20Sound4%20IMPACT%20%20RCEExploit, Third Party Advisory
https://www.sound4helpdesk.com/Product
https://www.sound4helpdesk.com/impact-downloads/Product

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.