CVE-2023-53970

🗓️ 22 Dec 2025 21:35:32Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 6 Views🌐 WEB

Authentication bypass Screen SFT DAB 600/C via reused session IDs to reset configs via API.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2023-53970	22 Dec 202523:17	–	circl
CNNVD	DB Elettronica Screen SFT DAB 600/C 访问控制错误漏洞	22 Dec 202500:00	–	cnnvd
Cvelist	CVE-2023-53970 Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Reset Board Config	22 Dec 202521:35	–	cvelist
EUVD	EUVD-2023-60232	23 Dec 202500:30	–	euvd
NVD	CVE-2023-53970	22 Dec 202522:16	–	nvd
OSV	CVE-2023-53970	22 Dec 202522:16	–	osv
Positive Technologies	PT-2025-52707	22 Dec 202500:00	–	ptsecurity
Vulnrichment	CVE-2023-53970 Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Reset Board Config	22 Dec 202521:35	–	vulnrichment
Zero Science Lab	Screen SFT DAB 600/C Authentication Bypass Reset Board Config Exploit	13 May 202300:00	–	zeroscience

NVD

Node

dbbroadcast sft_dab_600/c_firmwareMatch1.9.3

AND

dbbroadcast sft_dab_600/cMatch-

[
  {
    "vendor": "DB Elettronica Telecomunicazioni SpA",
    "product": "Screen SFT DAB 600/C",
    "versions": [
      {
        "version": "-",
        "status": "affected"
      }
    ]
  }
]

Source	Link
dbbroadcast	www.dbbroadcast.com/
dbbroadcast	www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5775.php
vulncheck	www.vulncheck.com/advisories/screen-sft-dab-c-firmware-authentication-bypass-reset-board-config
exploit-db	www.exploit-db.com/exploits/51459

Parameter	Position	Path	Description	CWE
ssbtIdx	request body	system/api/deviceManagement.cgx	Weak session management enables IP-bound session hijacking to issue unauthorized device reset via the vulnerable API endpoint.	CWE-306
ssbtType	request body	system/api/deviceManagement.cgx	Weak session management enables IP-bound session hijacking to issue unauthorized device reset via the vulnerable API endpoint.	CWE-306
ssbtObj	request body	system/api/deviceManagement.cgx	Weak session management enables IP-bound session hijacking to issue unauthorized device reset via the vulnerable API endpoint.	CWE-306
ssbtObj.reset	request body	system/api/deviceManagement.cgx	Weak session management enables IP-bound session hijacking to issue unauthorized device reset via the vulnerable API endpoint.	CWE-306

26 Dec 2025 16:51Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.17.5

CVSS 48.7

EPSS0.00255

SSVC

CWE-306