CVE-2023-53968
9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Summary
Screen SFT DAB 600/C Firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorized requests to the userManager API to remove user accounts without proper authentication.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| DB Elettronica Telecomunicazioni SpA | Screen SFT DAB 600/C | - | affected |
Weaknesses
- CWE-306: Missing Authentication for Critical Function
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: yes
- Technical Impact: total
Additional References
References
- https://www.exploit-db.com/exploits/51457
- https://www.dbbroadcast.com
- https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5773.php
- https://www.vulncheck.com/advisories/screen-sft-dab-c-firmware-authentication-bypass-erase-account
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.