CVEvulnerability
CVE-2023-7328
6.9 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2025-11-14
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 6.9 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-306
Description
Screen SFT DAB 600/C firmware versions up to and including 1.9.3 contain an improper access control on the user management API allows unauthenticated requests to retrieve structured user data, including account names and connection metadata such as client IP and timeout values.
Affected configurations
• dbbroadcast sft dab 600\/c firmware (<= 1.9.3)
Related
Weakness · CWE (1)
- CWE-306 Missing Authentication for Critical Functionality weakness
References
- https://packetstormsecurity.com/files/172332/ Third Party Advisory
- https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/ Product
- https://www.exploit-db.com/exploits/51460 Exploit
- https://www.vulncheck.com/advisories/screen-sft-dab-600c-unauthenticated-information-disclosure Third Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5776.php Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/51460 Exploit
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5776.php Exploit, Third Party Advisory