Unauthenticated remote attackers can trigger a factory reset on various SOUND4 audio processing devices, leading to a complete loss of configuration and potential unauthorized system access.

The device fails to perform authentication checks on the /usr/cgi-bin/restorefactory.cgi endpoint. An unauthenticated attacker can send a crafted POST request to this endpoint to force the device to reset to factory defaults, effectively clearing existing security configurations and allowing the attacker to establish administrative control using default credentials.

The vulnerability poses a severe risk to broadcast infrastructure, as successful exploitation results in immediate service disruption and a total loss of device configuration. With a CVSS score of 7.5, the risk is classified as High, reflecting the potential for unauthorized actors to hijack critical audio processing hardware, potentially leading to unauthorized broadcasts or the permanent denial of service for affected radio stations.

Immediate Action: As no vendor patch is currently confirmed, administrators should immediately isolate vulnerable devices from the public internet and restrict access to the management interface to trusted internal networks only.

Proactive Monitoring: Monitor network traffic for any unexpected POST requests directed at the /usr/cgi-bin/restorefactory.cgi endpoint and audit device configuration logs for unauthorized reset events.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an access control list (ACL) to block all external access to the vulnerable CGI script until a firmware update is provided by the manufacturer.

Public Exploit Available: Yes, a proof-of-concept exploit is available via the Exploit Database (EDB-ID: 51174).

Given the ease of exploitation and the critical nature of broadcast equipment, organizations must treat this vulnerability with high urgency. Immediately restrict network access to affected devices to prevent unauthorized remote reset commands, and maintain close contact with the vendor for official firmware updates to remediate the underlying authentication failure.