CVE-2023-53969
BaseFortify
Publication date: 2025-12-22
Last updated on: 2025-12-26
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dbbroadcast | sft_dab_600\/c_firmware | 1.9.3 |
| dbbroadcast | sft_dab_600\/c | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2023-53969 is a session management vulnerability in Screen SFT DAB 600/C firmware version 1.9.3. It allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address to send unauthorized requests to the userManager API, enabling them to change user passwords without proper authentication. [1]
How can this vulnerability impact me? :
This vulnerability can lead to critical unauthorized access and control over user credentials. Attackers can change user passwords without authentication, potentially compromising system security and allowing further unauthorized actions. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows attackers to bypass authentication and change user passwords without proper authorization, which could lead to unauthorized access to sensitive user credentials. This unauthorized access and control over user accounts may result in non-compliance with standards and regulations such as GDPR and HIPAA that require strict access controls and protection of personal data. However, specific impacts on compliance are not detailed in the provided resources. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update the Screen SFT DAB 600/C firmware from version 1.9.3 to a patched version once available. Additionally, restrict access to the userManager API to trusted IP addresses and monitor for unauthorized requests that reuse the same IP address to change user passwords. Implement network-level controls to prevent IP address spoofing and session reuse. [1]