Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorized requests to the userManager API to change user passwords without proper authentication.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 9.3 · dbbroadcastNVD modified 2026-10-28 19:10
Affected (CPE criteria) 1
cpe:2.3:o:dbbroadcast:sft_dab_600\/c_firmware:1.9.3:*:*:*:*:*:*:*
References 6
- https://www.dbbroadcast.com Product
- https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/ Product
- https://www.exploit-db.com/exploits/51456 Exploit
- https://www.vulncheck.com/advisories/screen-sft-dab-c-firmware-authentication-bypass-password-change Third Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5772.php Exploit, Third Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5772.php Exploit, Third Party Advisory