CVE-2023-53964

CVE-2023-53964 is an unauthenticated vulnerability (CWE-306) in the /usr/cgi-bin/restorefactory.cgi endpoint of SOUND4 IMPACT, FIRST, PULSE, and Eco devices running version 2.x. It allows remote attackers to send a POST request with specific data to trigger a factory reset of the device configuration, bypassing authentication and enabling full system control. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Any unauthenticated remote attacker with network access to the device can exploit this vulnerability due to the lack of authentication checks (PR:N) and low attack complexity (AC:L), with no user interaction required (UI:N). Exploitation resets the device to factory settings, disrupting operations and providing the attacker with full system control, severely impacting confidentiality, integrity, and availability.

Advisories from VulnCheck and Zero Science Laboratory (ZSL-2022-5742) detail the unauthenticated factory reset vulnerability, while a proof-of-concept exploit is publicly available on Exploit-DB (exploit 51174). An archived version of the vendor's website is referenced, but no vendor patches or specific mitigation guidance are provided in the available references.