by Kastro
Paper/Archive/CVE-2023-53968

CVE-2023-53968

DB Elettronica Telecomunicazioni SpA Screen SFT DAB 600/C — Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Erase Account

EPSS 0.6%public exploitCVSS 9.8
critical.is priorityof 100
50
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.5.505 × 2010.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Screen SFT DAB 600/C Firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorized requests to the userManager API to remove user accounts without proper authentication.

Affected

ProductAffectedFixed inSource
Screen SFT DAB 600/C-–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitexploit-db.com/exploits/51457refdbbroadcast.comrefdbbroadcast.com/products/radio/sft-dab-series-compact-airexploitzeroscience.mk/en/vulnerabilities/ZSL-2023-5773.phpwriteupvulncheck.com/advisories/screen-sft-dab-c-firmware-authentication-bypass-erase-account