CVE-2023-53964

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated vulnerability in the /usr/cgi-bin/restorefactory.cgi endpoint that allows remote attackers to reset device configuration. Attackers can send a POST request to the endpoint with specific data to trigger a factory reset and bypass authentication, gaining full system control.

Affected products

Eco, First, Pulse, Sound4 Impact

sound4 Impact Firmware

= 2.15

Fix

Available

CVSS 3.1

9.8 CRITICAL

EPSS

0.9% (56th percentile)

Weakness

CWE-306

NVD status

Modified

Published

2025-12-22