SOUND4 Impact, Pulse, First, and Eco Unauthenticated Radio Stream Disclosure Vulnerability

A vulnerability exists in SOUND4 IMPACT, FIRST, PULSE, and Eco versions 2.x and below, allowing remote attackers to access live radio stream information without authentication. This is achieved by calling specific web scripts, such as through webplay or ffmpeg, to disclose details about the radio stream.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive information, specifically live radio stream details.

Reproduction

The vulnerability can be reproduced by sending a request to the server that includes the targeted webplay or ffmpeg script. This can be done using a web browser or a command-line tool that supports HTTP requests. The server response will include the live radio stream information, demonstrating the successful exploitation of the vulnerability.