CVE-2023-53969
📋 TL;DR
This authentication bypass vulnerability in Screen SFT DAB 600/C firmware allows attackers to change user passwords without proper authentication by exploiting IP address session binding. Attackers can reuse the same IP address to issue unauthorized requests to the userManager API. This affects organizations using Screen SFT DAB 600/C devices with firmware version 1.9.3.
💻 Affected Systems
- Screen SFT DAB 600/C
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to the device, change all passwords, lock out legitimate users, and potentially compromise broadcast systems or use the device as an attack pivot point.
Likely Case
Attackers change administrative passwords to gain persistent access, potentially disrupting broadcast operations or using the device for unauthorized activities.
If Mitigated
With proper network segmentation and access controls, impact is limited to the isolated device with no lateral movement to critical systems.
🎯 Exploit Status
Exploit code is publicly available on Exploit-DB and other sources, making this easily weaponizable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.dbbroadcast.com
Restart Required: No
Instructions:
Check vendor website for firmware updates. If available, download and apply the latest firmware following vendor instructions.
🔧 Temporary Workarounds
Network Segmentation
allIsolate the affected device from untrusted networks and restrict access to management interfaces.
Access Control Lists
allImplement strict firewall rules to limit which IP addresses can access the device's management interface.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the device from untrusted networks
- Monitor network traffic for unauthorized access attempts to the userManager API
🔍 How to Verify
Check if Vulnerable:
Check firmware version via device web interface or console. If version is 1.9.3, device is vulnerable.Check Version:
Check via device web interface or vendor-specific CLI commandsVerify Fix Applied:
Verify firmware version has been updated to a version later than 1.9.3.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by successful password change requests
- Password change requests from unusual IP addresses
Network Indicators:
- HTTP POST requests to /userManager API without proper authentication headers
- Unusual traffic patterns to device management interface
SIEM Query:
source_ip=* AND dest_port=80 AND http_method=POST AND uri_path="/userManager" AND NOT auth_token=*🔗 References
- https://www.dbbroadcast.com
- https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/
- https://www.exploit-db.com/exploits/51456
- https://www.vulncheck.com/advisories/screen-sft-dab-c-firmware-authentication-bypass-password-change
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5772.php
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5772.php
