RCE in Kantar Media Wm2
CVE-2022-50795
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory. Unauthenticated attackers can execute commands by making a single HTTP POST request to the traceroute.php script, which triggers the malicious file and then deletes it after execution.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.042 (90.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 91st percentile — 90.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.042 · newest: 0.042 · change: -0.001
Affected products
- Kantar Media Wm2 — versions 1.11
- Sound4 Big Voice2
- Sound4 Big Voice2 Firmware — versions 1.30
- Sound4 Big Voice4
- Sound4 Big Voice4 Firmware — versions 1.2
- Sound4 First — versions 2.0, 1.0
- Sound4 First Firmware — versions 2.15, 1.69
- Sound4 Impact — versions 2.0, 1.0
- Sound4 Impact Eco
- Sound4 Impact Eco Firmware — versions 1.16
Weakness classification (CWE)
References
- Zero Science Lab Disclosure (ZSL-2022-5740) (Exploit, Third Party Advisory, third-party-advisory)
- Packet Storm Security Exploit Details (Exploit, exploit, Third Party Advisory)
- IBM X-Force Vulnerability Exchange Entry (Third Party Advisory, vdb-entry)
- SOUND4 Product Homepage (Product, product)
- VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via traceroute.php (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2022-50795?
- CVE-2022-50795 is a high-severity vulnerability in Kantar Media Wm2, classified under OS Command Injection. CVSS score: 7.8/10. Published 2025-12-30.
- How severe is CVE-2022-50795?
- High severity. CVSS v3 base score is 7.8 out of 10.