PatchTheCVEpulse eco firmware vulnerabilities and fixes
Recent CVEs affecting pulse eco firmware, with upgrade or downgrade steps. 18 tracked.
Also searched as: pulseecofirmware.
pulse eco firmware has 18 tracked vulnerabilities, 8 critical. A fixed release or vendor patch exists for 13. Most recent: 2025-12-30. Highest priority: CVE-2022-50794 (score 70/100).
- CVE-2022-50796 CRITICAL 9.8 MITIGATE MITIGATE SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an unauthenticated remote code execution vulnerability in the fir
- CVE-2023-53964 CRITICAL 9.8 MITIGATE MITIGATE SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated vulnerability in the /usr/cgi-bin/restorefactor
- CVE-2023-53963 CRITICAL 9.8 MITIGATE MITIGATE SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows
- CVE-2023-53961 MEDIUM 4.3 MITIGATE MITIGATE SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains a cross-site request forgery vulnerability that allows attackers t
- CVE-2023-53960 CRITICAL 9.8 MITIGATE MITIGATE SOUND4 IMPACT/FIRST/PULSE/Eco version 2.x contains an SQL injection vulnerability in the 'index.php' authentic
- CVE-2023-53955 CRITICAL 9.8 DOWNGRADE MITIGATE SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows atta
- CVE-2022-50795 HIGH 7.8 MITIGATE MITIGATE SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local a
- CVE-2022-50794 CRITICAL 9.8 MITIGATE MITIGATE SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerabilit
- CVE-2022-50793 HIGH 8.8 MITIGATE MITIGATE SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an authenticated command injection vulnerability in the www-data-
- CVE-2022-50792 HIGH 7.5 MITIGATE MITIGATE SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated file disclosure vulnerability
- CVE-2022-50791 HIGH 7.8 MITIGATE MITIGATE SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local a
- CVE-2022-50790 HIGH 7.5 MITIGATE MITIGATE SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated vulnerability that allows remo
- CVE-2022-50789 HIGH 7.8 MITIGATE MITIGATE SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a command injection vulnerability that allows local authenticated
- CVE-2022-50788 HIGH 7.5 MITIGATE MITIGATE SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an information disclosure vulnerability that allows unauthenticat
- CVE-2022-50787 HIGH 7.2 MITIGATE MITIGATE SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x contains an unauthenticated stored cross-site scripting vulnerabili
- CVE-2022-50696 CRITICAL 9.8 MITIGATE MITIGATE SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries
- CVE-2022-50694 CRITICAL 9.8 MITIGATE MITIGATE SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an SQL injection vulnerability in the 'username' POST parameter o
- CVE-2022-50692 HIGH 7.5 DOWNGRADE MITIGATE SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an insufficient session expiration vulnerability
FAQ
How do I fix pulse eco firmware vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is pulse eco firmware being exploited right now?
None of the tracked pulse eco firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which pulse eco firmware CVE should I patch first?
CVE-2022-50794 currently ranks highest (70/100): SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerabilit.