CVE-2023-53965 SOUND4 Server Service 4.1.102 Local Privilege Escalation via Unquoted Service Path
Local attackers can escalate privileges to SYSTEM by exploiting an unquoted service path in SOUND4 Server Service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-53965?
CVE-2023-53965 is a high-severity vulnerability in SOUND4 Server Service, published on 22 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
SOUND4 Server Service 4.1.102 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted binary path by inserting malicious code in the system root path that could execute with LocalSystem privileges during service startup.
Weakness: CWE-428
Which versions are affected by CVE-2023-53965?
It affects 15 products.
Products include Sound4 Big Voice Firmware, Sound4 First Firmware, Sound4 Impact Eco Firmware, Sound4 Impact Firmware, Sound4 Ip Connect Firmware, Sound4 Playout Ula8 Firmware and 9 more.
How do I fix CVE-2023-53965?
No fix has been published for CVE-2023-53965 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-53965 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-53965 exists.
Sources
Also known as GHSA-34xc-rrm5-3hhj.