CVE-2023-53970
BaseFortify
Publication date: 2025-12-22
Last updated on: 2025-12-26
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dbbroadcast | sft_dab_600\/c_firmware | 1.9.3 |
| dbbroadcast | sft_dab_600\/c | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2023-53970 is a vulnerability in Screen SFT DAB 600/C Firmware version 1.9.3 where weak session management allows attackers to bypass authentication controls. Attackers can reuse IP-bound session identifiers and send specially crafted POST requests with manipulated session parameters to a vulnerable device management API endpoint. This lets them reset the device's configuration without proper authentication. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker to reset the device's configuration without authentication, potentially disrupting device operation or enabling unauthorized changes. Since the attacker can bypass authentication controls remotely, it poses a high risk to device security and operational integrity. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring network traffic for crafted POST requests sent to the device management API endpoint that include manipulated session parameters attempting to reuse IP-bound session identifiers. Specific detection commands are not provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the device management API endpoint to trusted networks or IP addresses, monitoring for suspicious POST requests with manipulated session parameters, and applying any available firmware updates or patches from the vendor to address the weak session management vulnerability. [1]