CVE-2023-53741
📋 TL;DR
Screen SFT DAB 1.9.3 has a weak session management vulnerability where attackers can bypass authentication by reusing IP-bound session identifiers. This allows unauthorized removal of user accounts through API exploitation. Organizations using Screen SFT DAB 1.9.3 for radio broadcasting are affected.
💻 Affected Systems
- Screen SFT DAB Series Compact Air
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could delete all user accounts, disrupt broadcasting operations, and potentially gain administrative control over the system.
Likely Case
Unauthorized deletion of user accounts leading to operational disruption and potential privilege escalation.
If Mitigated
Limited impact with proper network segmentation and monitoring, though authentication bypass remains possible.
🎯 Exploit Status
Exploit code available on Exploit-DB (ID 51457), requiring only network access and session interception.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.screen.it
Restart Required: No
Instructions:
Check vendor website for security updates. No official patch documented at time of analysis.
🔧 Temporary Workarounds
Network Segmentation
allIsolate SFT DAB systems from untrusted networks
Session Monitoring
allMonitor for unusual session reuse patterns
🧯 If You Can't Patch
- Implement strict network access controls to limit API exposure
- Deploy web application firewall with session validation rules
🔍 How to Verify
Check if Vulnerable:
Check if running SFT DAB version 1.9.3 and test session reuse via API with different IP addressesCheck Version:
Check device web interface or contact vendor for version informationVerify Fix Applied:
Verify session identifiers are properly invalidated and not IP-bound after updates📡 Detection & Monitoring
Log Indicators:
- Multiple user account deletion events from same session
- Session reuse from different IP addresses
Network Indicators:
- API calls to user deletion endpoints without proper authentication sequence
- Session ID reuse patterns
SIEM Query:
source="sft-dab" AND (event="user_delete" OR event="session_reuse")🔗 References
- https://www.dbbroadcast.com
- https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/
- https://www.exploit-db.com/exploits/51457
- https://www.screen.it
- https://www.vulncheck.com/advisories/screen-sft-dab-authentication-bypass-via-ip-session-management
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5773.php
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5773.php
