CVEvulnerability
CVE-2023-53968
9.3 CRITICAL
Official page ↗
- Status
- Analyzed
- Published
- 2025-12-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 9.3 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-306
Description
Screen SFT DAB 600/C Firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorized requests to the userManager API to remove user accounts without proper authentication.
Affected configurations
• dbbroadcast sft dab 600\/c firmware 1.9.3
Related
Weakness · CWE (1)
- CWE-306 Missing Authentication for Critical Functionality weakness
References
- https://www.dbbroadcast.com Product
- https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/ Product
- https://www.exploit-db.com/exploits/51457 Exploit
- https://www.vulncheck.com/advisories/screen-sft-dab-c-firmware-authentication-bypass-erase-account Exploit, Third Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5773.php Exploit, Third Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5773.php Exploit, Third Party Advisory