Vulnerability · Published Dec 30, 2025 · Assigned by VulnCheck
CVE-2022-50692SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Insufficient Session Expiration Vulnerability
High 7.5
In plain English
A high-severity security flaw in WM2 from Kantar Media. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 51.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an insufficient session expiration vulnerability that allows attackers to reuse old session credentials. Attackers can exploit weak session management to potentially hijack active user sessions and gain unauthorized access to the application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SOUND4 Ltd. | Impact/Pulse/First | Version 2: 1.1/2.15 |
| SOUND4 Ltd. | Impact/Pulse Eco | 1.16 |
| SOUND4 Ltd. | BigVoice4 | 1.2 |
| SOUND4 Ltd. | BigVoice2 | 1.30 |
| SOUND4 Ltd. | Stream | 1.1/2.4.29 |
| Kantar Media | WM2 | 1.11 |
Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- Zero Science Lab Disclosure (ZSL-2022-5724) third-party-advisory
- Packet Storm Security Exploit Entry exploit
- CXSecurity Vulnerability Listing third-party-advisory
- IBM X-Force Vulnerability Exchange vdb-entry
- SOUND4 Product Homepage product
- VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Insufficient Session Expiration Vulnerability third-party-advisory