CVE-2023-53969criticalCWE-306

CVE-2023-53969: critical vulnerability in DB Elettronica Telecomunicazioni SpA Screen…

Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Password Change

Published

Follow this CVE+ Monitor Screen SFT DAB 600/C

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.5%
Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorized requests to the userManager API to change user passwords without proper authentication.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
DB Elettronica Telecomunicazioni SpA · Screen SFT DAB 600/C
Related CVEs — DB Elettronica Telecomunicazioni SpA Screen…

In the same product, most dangerous first.

CVE-2023-53968CRITICALScreen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Erase AccountEPSS 0.6%CVE-2023-53970HIGHScreen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Reset Board ConfigEPSS 0.5%CVE-2023-53967CRITICALScreen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Admin Password ChangeEPSS 0.5%CVE-2023-7328MEDIUMScreen SFT DAB 600/C <= 1.9.3 Unauthenticated Information DisclosureEPSS 0.4%