CVEvulnerability
CVE-2023-53969
9.3 CRITICAL
Official page ↗
- Status
- Analyzed
- Published
- 2025-12-22
- Last modified
- 2026-10-28
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 9.3 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-306
Description
Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorized requests to the userManager API to change user passwords without proper authentication.
Affected configurations
• dbbroadcast sft dab 600\/c firmware 1.9.3
Related
Weakness · CWE (1)
- CWE-306 Missing Authentication for Critical Functionality weakness
References
- https://www.dbbroadcast.com Product
- https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/ Product
- https://www.exploit-db.com/exploits/51456 Exploit
- https://www.vulncheck.com/advisories/screen-sft-dab-c-firmware-authentication-bypass-password-change Third Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5772.php Exploit, Third Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5772.php Exploit, Third Party Advisory