CVE-2023-53968

CVE-2023-53968 is a session management vulnerability (CWE-306) affecting Screen SFT DAB 600/C Firmware version 1.9.3, with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw stems from improper IP address session binding, allowing attackers to bypass authentication controls. By reusing the same IP address, unauthorized parties can issue requests to the userManager API, enabling actions such as removing user accounts without valid credentials.

The vulnerability is exploitable by remote attackers with network access and no privileges or user interaction required. An attacker sharing or spoofing the victim's IP address can directly target the userManager API endpoint to delete accounts, potentially disrupting access controls and administrative functions on the affected DAB (Digital Audio Broadcasting) device.

Advisories from VulnCheck and Zero Science Laboratory document the authentication bypass leading to account erasure, while an exploit is publicly available on Exploit-DB. Manufacturer DB Broadcast provides product details for the SFT DAB series on their website, though specific patch information is not detailed in the provided references.

Public availability of the exploit on Exploit-DB indicates potential for real-world exploitation against unpatched instances of this firmware.