Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2023-7328

Screen SFT DAB 600/C <= 1.9.3 Unauthenticated Information Disclosure

Screen SFT DAB 600/C firmware versions up to and including 1.9.3 contain an improper access control on the user management API allows unauthenticated requests to retrieve structured user data, including account names and connection metadata such as client IP and timeout values.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Db Elettronica Dbbroadcast
Products
Screen Sft Dab 600c Sft Dab 600/c Sft Dab 600\/c and 1 more
CVE-2023-53970

Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Reset Board Config

Screen SFT DAB 600/C Firmware 1.9.3 contains a weak session management vulnerability that allows attackers to bypass authentication controls by reusing IP-bound session identifiers. Attackers can exploit the vulnerable deviceManagement API endpoint to reset device configurations by sending crafted POST requests with manipulated session parameters.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Db Elettronica Dbbroadcast
Products
Screen Sft Dab 600c Sft Dab 600\/c Sft Dab 600\/c Firmware
CVE-2023-53969

Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Password Change

Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorized requests to the userManager API to change user passwords without proper authentication.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Db Elettronica Dbbroadcast
Products
Screen Sft Dab 600c Sft Dab 600\/c Sft Dab 600\/c Firmware
CVE-2023-53967

Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Admin Password Change

Screen SFT DAB 600/C firmware 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without requiring the current credentials. Attackers can exploit the userManager.cgx API endpoint by sending a crafted POST request with a new MD5-hashed password to directly modify the admin account's authentication.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Db Elettronica Dbbroadcast
Products
Screen Sft Dab 600c Sft Dab 600\/c Sft Dab 600\/c Firmware
CVE-2023-53968

Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Erase Account

Screen SFT DAB 600/C Firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorized requests to the userManager API to remove user accounts without proper authentication.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Db Elettronica Dbbroadcast
Products
Screen Sft Dab 600c Sft Dab 600\/c Sft Dab 600\/c Firmware