---
id: CVE-2023-53955
title: >-
  SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Authorization Bypass via Insecure Object
  References
summary: >-
  SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object
  reference vulnerability that allows attackers to bypass authorization and
  access hidden system resources. Attackers can exploit the vulnerability by
  manipulating user-…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-639
vendor: SOUND4 Ltd.
product: Impact/Pulse/First
affected:
  - 'Impact/Pulse/First Version 2: 1.1/2.15'
  - impact_pulse_eco 1.16
  - BigVoice4 1.2
  - BigVoice2 1.30
  - Stream 1.1/2.4.29
  - WM2 1.11
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2025-12-22T21:56:56.786718Z'
exploitAvailable: true
published: '2025-12-22'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T19:19:13.733Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-53955'
references:
  - url: 'https://www.exploit-db.com/exploits/51169'
    label: ExploitDB-51169
  - url: 'https://web.archive.org/web/20221207074555/https://www.sound4.com/'
    label: SOUND4 Official Product Homepage
  - url: 'https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5723.php'
    label: Zero Science Lab Disclosure (ZSL-2022-5723)
  - url: >-
      https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-authorization-bypass-via-insecure-object-references
    label: >-
      VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Authorization
      Bypass via Insecure Object References
tags:
  - cve.org
  - exploit-available
epss: 0.00852
epssPercentile: 0.58049
ingestedAt: '2026-10-01T19:58:57.577Z'
---

## Overview

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows attackers to bypass authorization and access hidden system resources. Attackers can exploit the vulnerability by manipulating user-supplied input to execute privileged functionalities without proper authentication.

## Affected

- `Impact/Pulse/First Version 2: 1.1/2.15`
- `impact_pulse_eco 1.16`
- `BigVoice4 1.2`
- `BigVoice2 1.30`
- `Stream 1.1/2.4.29`
- `WM2 1.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.