CVE-2023-53775
📋 TL;DR
CVE-2023-53775 is an authentication bypass vulnerability in Screen SFT DAB 1.9.3 that allows attackers to change user passwords without proper authentication by exploiting weak session management. Attackers can reuse IP-bound session identifiers to make unauthorized requests to the userManager API. This affects organizations using Screen SFT DAB 1.9.3 for digital audio broadcasting.
💻 Affected Systems
- Screen SFT DAB
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to the broadcasting system, potentially disrupting operations, modifying configurations, or accessing sensitive broadcast data.
Likely Case
Unauthorized password changes leading to account takeover, service disruption, or unauthorized access to broadcasting controls.
If Mitigated
Limited impact with proper network segmentation and monitoring, but authentication bypass remains possible.
🎯 Exploit Status
Exploit code is publicly available on Exploit-DB (ID 51456), making exploitation straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.screen.it
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates and apply when released.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Screen SFT DAB systems from untrusted networks and restrict access to management interfaces.
API Access Restriction
allBlock or restrict access to the userManager API endpoint using firewall rules or web application firewall.
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the SFT DAB management interface.
- Monitor for unusual API requests to userManager endpoint and implement alerting for password change attempts.
🔍 How to Verify
Check if Vulnerable:
Check if running Screen SFT DAB version 1.9.3. Test if unauthorized password change requests to userManager API succeed using available exploit code.Check Version:
Check device web interface or documentation for version information.Verify Fix Applied:
Verify updated version is installed and test that password change requests without proper authentication fail.📡 Detection & Monitoring
Log Indicators:
- Unusual userManager API requests from unexpected IP addresses
- Multiple failed authentication attempts followed by successful password changes
Network Indicators:
- HTTP POST requests to /userManager endpoint from unauthorized sources
- Unusual traffic patterns to management interface
SIEM Query:
source_ip NOT IN authorized_ips AND destination_port=80 AND uri_path CONTAINS '/userManager' AND http_method='POST'🔗 References
- https://www.dbbroadcast.com
- https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/
- https://www.exploit-db.com/exploits/51456
- https://www.screen.it
- https://www.vulncheck.com/advisories/screen-sft-dab-authentication-bypass-via-user-password-change
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5772.php
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5772.php
