CVE-2023-53964

CRITICAL

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - RCE

Title source: llm

Description

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated vulnerability in the /usr/cgi-bin/restorefactory.cgi endpoint that allows remote attackers to reset device configuration. Attackers can send a POST request to the endpoint with specific data to trigger a factory reset and bypass authentication, gaining full system control.

Exploits (1)

exploitdb WORKING POC

by LiquidWorm · textlocalwindows

https://www.exploit-db.com/exploits/51174

View Code ZIP pw:eip

References (4)

[Product] https://web.archive.org/web/20221207074555/https://www.sound4.com/

[Exploit, Third Party Advisory, VDB Entry] https://www.exploit-db.com/exploits/51174

[Third Party Advisory] https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-factory-reset-vulnerability

[Exploit, Third Party Advisory] https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5742.php

Scores

CVSS v3 9.8

EPSS 0.0121

EPSS Percentile 79.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-306

Status published

Products (12)

sound4/big_voice2_firmware 1.30

sound4/big_voice4_firmware 1.2

sound4/first_firmware 2.15

sound4/first_firmware 1.69

sound4/impact_eco_firmware 1.16

sound4/impact_firmware 2.15

sound4/impact_firmware 1.69

sound4/pulse_eco_firmware 1.16

sound4/pulse_firmware 2.15

sound4/pulse_firmware 1.69

... and 2 more

Published Dec 22, 2025

Tracked Since Feb 18, 2026