CVE-2023-53969

HighCVSS 7.5/10Last modified Oct 28, 2026

Description

Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorized requests to the userManager API to change user passwords without proper authentication.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
DB Elettronica Telecomunicazioni SpA	Screen SFT DAB 600/C	-

References

https://www.dbbroadcast.comProduct
https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/Product
https://www.exploit-db.com/exploits/51456Exploit
https://www.vulncheck.com/advisories/screen-sft-dab-c-firmware-authentication-bypass-password-changeThird Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5772.phpExploit, Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5772.phpExploit, Third Party Advisory

Timeline

Published: Dec 22, 2025
Last modified: Oct 28, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-53978.1Server receiving a malformed message to create a new connection could lead to an attacker performing remote code execution or causing a fail CVE-2023-539707.5Screen SFT DAB 600/C Firmware 1.9.3 contains a weak session management vulnerability that allows attackers to bypass authentication controls CVE-2023-539718.8WebTareas 2.4 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the chat photo uplo CVE-2023-539727.5WebTareas 2.4 contains a SQL injection vulnerability in the webTareasSID cookie parameter that allows unauthenticated attackers to manipulat CVE-2023-539737.8Zillya Total Security 3.0.2367.0 contains a privilege escalation vulnerability that allows low-privileged users to copy files to unauthorize CVE-2023-539747.5D-Link DSL-124 ME_1.00 contains a configuration file disclosure vulnerability that allows unauthenticated attackers to retrieve router setti CVE-2023-539757.5Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unv CVE-2023-539765.4myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the template management system that allows authenticated administ CVE-2023-539775.4myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum management system that allows authenticated administrat CVE-2023-539785.4myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum announcement system that allows authenticated administr CVE-2023-539798.8MyBB 1.8.32 contains a chained vulnerability that allows authenticated administrators to bypass avatar upload restrictions and execute arbit CVE-2023-53985.9Server receiving a malformed message based on a list of IPs resulting in heap corruption causing a denial of service. See Honeywell Security