CVE-2023-53964

Critical · 9.8

CVSS

9.8

EPSS

1.0%

Published

Dec 22, 2025

CISA due date

—

The record

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated vulnerability in the /usr/cgi-bin/restorefactory.cgi endpoint that allows remote attackers to reset device configuration. Attackers can send a POST request to the endpoint with specific data to trigger a factory reset and bypass authentication, gaining full system control.

Affected packages

Ecosystem	Package	Introduced	Fixed