CVE-2023-7328

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Screen SFT DAB 600/C firmware versions up to and including 1.9.3 contain an improper access control on the user management API allows unauthenticated requests to retrieve structured user data, including account names and connection metadata such as client IP and timeout values.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
DB Elettronica Telecomunicazioni SpA	Screen SFT DAB 600/C	<= 1.9.3

References

https://packetstormsecurity.com/files/172332/Third Party Advisory
https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/Product
https://www.exploit-db.com/exploits/51460Exploit
https://www.vulncheck.com/advisories/screen-sft-dab-600c-unauthenticated-information-disclosureThird Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5776.phpExploit, Third Party Advisory
https://www.exploit-db.com/exploits/51460Exploit
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5776.phpExploit, Third Party Advisory

Timeline

Published: Nov 14, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-73298.7Tinycontrol LAN Controller v3 (LK3) firmware versions up to 1.58a (hardware v3.8) contain a missing authentication vulnerability in the stm.CVE-2023-73309.3Ruijie NBR series routers contain an unauthenticated arbitrary file upload vulnerability via /ddi/server/fileupload.php. The endpoint accept CVE-2023-73314.7A vulnerability was detected in PKrystian Full-Stack-Bank up to bf73a0179e3ff07c0d7dc35297cea0be0e5b1317. This vulnerability affects unknown CVE-2023-73327.1PocketMine-MP versions prior to 4.18.1 contain an improper input validation vulnerability in inventory transaction handling. A remote attack CVE-2023-73335.3A weakness has been identified in bluelabsio records-mover up to 1.5.4. The affected element is an unknown function of the component Table O CVE-2023-73349.8Changjetong T+ versions up to and including 16.x contain a .NET deserialization vulnerability in an AjaxPro endpoint that can lead to remote CVE-2023-73358.7EduSoho versions prior to 22.4.7 contain an arbitrary file read vulnerability in the classroom-course-statistics export functionality. A rem CVE-2023-73377.5The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the 'js-support-ticket-toke CVE-2023-73387.5Ruckus Unleashed contains a remote code execution vulnerability in the web-based management interface that allows authenticated remote attac CVE-2023-73396.5Stack-based buffer overflow vulnerability in Softing Industrial Automation GmbH gateways allows overflow buffers. This issue affects pnGate:CVE-2023-73404.3Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sendin CVE-2023-73428.8HiSecOS web server versions 03.4.00 prior to 04.1.00 contains a privilege escalation vulnerability that allows authenticated users with oper