CVE-2023-53969
Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Password Change
- State
- Published
- Severity
- 9.3 Critical
- Published
- Dec 22, 2025
- Updated
- Dec 22, 2025
- Reserved
- Dec 19, 2025
Description
Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorized requests to the userManager API to change user passwords without proper authentication.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
Screen SFT DAB 600/CDB Elettronica Telecomunicazioni SpA |
|
References
- ExploitDB-51456exploit
- DB Elettronica Telecomunicazioni Official Websiteproduct
- SFT DAB Series Product Pageproduct
- Zero Science Lab Disclosure (ZSL-2022-5772)third-party-advisory
- VulnCheck Advisory: Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Password Changethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.