CVE-2023-53955: SOUND4 Big VOICE2 Firmware

Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days.

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows attackers to bypass authorization and access hidden system resources. Attackers can exploit the vulnerability by manipulating user-supplied input to execute privileged functionalities without proper authentication.

Affected products

• SOUND4 Big VOICE2 Firmware: version 1.30 only
• SOUND4 Big VOICE4 Firmware: version 1.2 only
• SOUND4 First Firmware: version 1.69 only; version 2.15 only
• SOUND4 Impact Eco Firmware: version 1.16 only
• SOUND4 Impact Firmware: version 1.69 only; version 2.15 only
• SOUND4 Pulse Eco Firmware: version 1.16 only
• SOUND4 Pulse Firmware: version 1.69 only; version 2.15 only
• SOUND4 Stream Extension: version 2.4.29 only
• SOUND4 WM2 Firmware: version 1.11 only

Published 2025-12-22. Last modified 2026-06-17.