CVE-2023-53964

CRITICAL

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - RCE

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-53964. PoCs published by LiquidWorm.

AI-analyzed exploit summary This exploit demonstrates an unauthenticated factory reset vulnerability in SOUND4 IMPACT/FIRST/PULSE/Eco devices via a POST request to an unprotected CGI endpoint, allowing attackers to bypass authentication and take full control of the system.

Description

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated vulnerability in the /usr/cgi-bin/restorefactory.cgi endpoint that allows remote attackers to reset device configuration. Attackers can send a POST request to the endpoint with specific data to trigger a factory reset and bypass authentication, gaining full system control.

Exploits (1)

exploitdb WORKING POC

by LiquidWorm · textlocalwindows

https://www.exploit-db.com/exploits/51174

View Code ZIP pw:eip

This exploit demonstrates an unauthenticated factory reset vulnerability in SOUND4 IMPACT/FIRST/PULSE/Eco devices via a POST request to an unprotected CGI endpoint, allowing attackers to bypass authentication and take full control of the system.

Classification

Working Poc 100%

Attack Type

Auth Bypass

Complexity

Trivial

Reliability

Reliable

Target: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x

No auth needed

Prerequisites: Network access to the target device

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4

Core References

Exploit, Third Party Advisory, VDB Entry exploit

https://www.exploit-db.com/exploits/51174

Product product

https://web.archive.org/web/20221207074555/https://www.sound4.com/

Exploit, Third Party Advisory third-party-advisory

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5742.php

Third Party Advisory third-party-advisory

https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-factory-reset-vulnerability

Scores

CVSS v3 9.8

EPSS 0.0087

EPSS Percentile 54.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-306

Status published

Products (12)

sound4/big_voice2_firmware 1.30

sound4/big_voice4_firmware 1.2

sound4/first_firmware 2.15

sound4/first_firmware 1.69

sound4/impact_eco_firmware 1.16

sound4/impact_firmware 2.15

sound4/impact_firmware 1.69

sound4/pulse_eco_firmware 1.16

sound4/pulse_firmware 2.15

sound4/pulse_firmware 1.69

... and 2 more

Published Dec 22, 2025

Tracked Since Feb 18, 2026