6.9

CVE-2023-7328

Exploit

Screen SFT DAB 600/C <= 1.9.3 Unauthenticated Information Disclosure

Screen SFT DAB 600/C firmware versions up to and including 1.9.3 contain an improper access control on the user management API allows unauthenticated requests to retrieve structured user data, including account names and connection metadata such as client IP and timeout values.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dbbroadcast ≫ Sft Dab 600/c Firmware Version <= 1.9.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.3% 0.217
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
disclosure@vulncheck.com 6.9 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://www.exploit-db.com/exploits/51460
Exploit
https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/
Product
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5776.php
Third Party Advisory
Exploit
https://packetstormsecurity.com/files/172332/
Third Party Advisory
https://www.vulncheck.com/advisories/screen-sft-dab-600c-unauthenticated-information-disclosure
Third Party Advisory