CVE-2023-53964

CRITICAL 9.8CVE-2023-53964 · Published 22/12/2025 · updated 17/06/2026

In short

CVE-2023-53964 is a CRITICAL (CVSS 9.8) vulnerability affecting stream extension (sound4).
Chance of exploitation in the next 30 days (EPSS): 0.98%, higher than 62.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
stream extension sound4	`= 2.4.29`	No fix yet

Description

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated vulnerability in the /usr/cgi-bin/restorefactory.cgi endpoint that allows remote attackers to reset device configuration. Attackers can send a POST request to the endpoint with specific data to trigger a factory reset and bypass authentication, gaining full system control.

References

web.archive.org/web/20221207074555/https://www.sound4.com · Product
exploit-db.com/exploits/51174 · Exploit
vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-factory-reset-vulnerability · Third Party Advisory
zeroscience.mk/en/vulnerabilities/ZSL-2022-5742.php · Exploit

More vulnerabilities in stream extension

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

stream extension

sound4

= 2.4.29

No fix yet

Description

More vulnerabilities in stream extension

See all →