CVE-2023-53970
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-22

Last updated on: 2025-12-26

Assigner: VulnCheck

Description
Screen SFT DAB 600/C Firmware 1.9.3 contains a weak session management vulnerability that allows attackers to bypass authentication controls by reusing IP-bound session identifiers. Attackers can exploit the vulnerable deviceManagement API endpoint to reset device configurations by sending crafted POST requests with manipulated session parameters.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-22
Last Modified
2025-12-26
Generated
2026-06-16
AI Q&A
2025-12-23
EPSS Evaluated
2026-06-15
NVD
CVE-2023-53970
EUVD
EUVD-2023-60232
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
dbbroadcast sft_dab_600\/c_firmware 1.9.3
dbbroadcast sft_dab_600\/c *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2023-53970 is a vulnerability in Screen SFT DAB 600/C Firmware version 1.9.3 where weak session management allows attackers to bypass authentication controls. Attackers can reuse IP-bound session identifiers and send specially crafted POST requests with manipulated session parameters to a vulnerable device management API endpoint. This lets them reset the device's configuration without proper authentication. [1]

Impact Analysis

This vulnerability can allow an attacker to reset the device's configuration without authentication, potentially disrupting device operation or enabling unauthorized changes. Since the attacker can bypass authentication controls remotely, it poses a high risk to device security and operational integrity. [1]

Detection Guidance

This vulnerability can be detected by monitoring network traffic for crafted POST requests sent to the device management API endpoint that include manipulated session parameters attempting to reuse IP-bound session identifiers. Specific detection commands are not provided in the available resources. [1]

Mitigation Strategies

Immediate mitigation steps include restricting access to the device management API endpoint to trusted networks or IP addresses, monitoring for suspicious POST requests with manipulated session parameters, and applying any available firmware updates or patches from the vendor to address the weak session management vulnerability. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2023-53970. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart