CVE-2023-53969

🗓️ 22 Dec 2025 21:35:31Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 5 Views🌐 WEB

CVE-2023-53969 allows authentication bypass on 1.9.3 via session binding to change passwords.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2023-53969	23 Dec 202517:21	–	circl
CNNVD	DB Elettronica Screen SFT DAB 600/C 访问控制错误漏洞	22 Dec 202500:00	–	cnnvd
Cvelist	CVE-2023-53969 Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Password Change	22 Dec 202521:35	–	cvelist
EUVD	EUVD-2023-60231	23 Dec 202500:30	–	euvd
NVD	CVE-2023-53969	22 Dec 202522:16	–	nvd
OSV	CVE-2023-53969	22 Dec 202522:16	–	osv
Positive Technologies	PT-2025-52706	22 Dec 202500:00	–	ptsecurity
Vulnrichment	CVE-2023-53969 Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Password Change	22 Dec 202521:35	–	vulnrichment
Zero Science Lab	Screen SFT DAB 600/C Authentication Bypass Password Change Exploit	13 May 202300:00	–	zeroscience

NVD

Node

dbbroadcast sft_dab_600/c_firmwareMatch1.9.3

AND

dbbroadcast sft_dab_600/cMatch-

[
  {
    "vendor": "DB Elettronica Telecomunicazioni SpA",
    "product": "Screen SFT DAB 600/C",
    "versions": [
      {
        "version": "-",
        "status": "affected"
      }
    ]
  }
]

Source	Link
dbbroadcast	www.dbbroadcast.com/
exploit-db	www.exploit-db.com/exploits/51456
dbbroadcast	www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/
vulncheck	www.vulncheck.com/advisories/screen-sft-dab-c-firmware-authentication-bypass-password-change
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5772.php

Parameter	Position	Path	Description	CWE
ssbtObj.changeUserPswd.username	request body	/system/api/userManager.cgx	Session management weakness enables authentication bypass by reusing the victim's IP-bound session to change user passwords via the vulnerable API.	CWE-306
ssbtObj.changeUserPswd.password	request body	/system/api/userManager.cgx	Session management weakness enables authentication bypass by reusing the victim's IP-bound session to change user passwords via the vulnerable API.	CWE-306
ssbtIdx	request body	/system/api/userManager.cgx	Session management weakness enables authentication bypass by reusing the victim's IP-bound session to change user passwords via the vulnerable API.	CWE-306
ssbtType	request body	/system/api/userManager.cgx	Session management weakness enables authentication bypass by reusing the victim's IP-bound session to change user passwords via the vulnerable API.	CWE-306

26 Dec 2025 16:50Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.17.5

CVSS 49.3

EPSS0.00255

SSVC

CWE-306