SecuriTricks - CVE-2023-53741

Description

Screen SFT DAB 1.9.3 contains a weak session management vulnerability that allows attackers to bypass authentication controls by reusing IP address-bound session identifiers. Attackers can exploit the vulnerable API by intercepting and reusing established sessions to remove user accounts without proper authorization.

Product(s) Impacted

Vendor	Product	Versions
Dbbroadcast	Sft Dab 015\/c Firmware Sft Dab 015\/c Sft Dab 050\/c Firmware Sft Dab 050\/c Sft Dab 150\/c Firmware Sft Dab 150\/c Sft Dab 300\/c Firmware Sft Dab 300\/c Sft Dab 600\/c Firmware Sft Dab 600\/c	1.9.3 - 1.9.3 - 1.9.3 - 1.9.3 - 1.9.3 -

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-384

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
o	dbbroadcast	sft_dab_015\/c_firmware	1.9.3	/	/	/	/	/	/	/
h	dbbroadcast	sft_dab_015\/c	-	/	/	/	/	/	/	/
o	dbbroadcast	sft_dab_050\/c_firmware	1.9.3	/	/	/	/	/	/	/
h	dbbroadcast	sft_dab_050\/c	-	/	/	/	/	/	/	/
o	dbbroadcast	sft_dab_150\/c_firmware	1.9.3	/	/	/	/	/	/	/
h	dbbroadcast	sft_dab_150\/c	-	/	/	/	/	/	/	/
o	dbbroadcast	sft_dab_300\/c_firmware	1.9.3	/	/	/	/	/	/	/
h	dbbroadcast	sft_dab_300\/c	-	/	/	/	/	/	/	/
o	dbbroadcast	sft_dab_600\/c_firmware	1.9.3	/	/	/	/	/	/	/
h	dbbroadcast	sft_dab_600\/c	-	/	/	/	/	/	/	/

References

https://www.dbbroadcast.com

https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/

https://www.exploit-db.com/exploits/51457

https://www.screen.it

https://www.vulncheck.com/advisories/screen-sft-dab-authentication-bypass-via-ip-session-management

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5773.php

CVSS Score

5.1 / 10

CVSS Data - 4.0

Attack Vector: NETWORK
Attack Complexity: LOW
Attack Requirements: NONE
Privileges Required: LOW
User Interaction: PASSIVE
Scope:
Confidentiality Impact: LOW
Integrity Impact: LOW
Availability Impact: NONE
Exploit Maturity: NOT_DEFINED

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

View Vector String

Timeline

Published: Dec. 10, 2025, 9:16 p.m.
Last Modified: Dec. 18, 2025, 9:15 p.m.

Status : Modified

CVE has been amended by a source (CVE Primary CNA or another CNA). Analysis data supplied by the NVD may be no longer be accurate due to these changes.

More info

Source

disclosure@vulncheck.com

CVE-2023-53741