External risk intelligence

Screen SFT DAB 600/C Firmware Authentication Bypass Via IP Binding

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2023-53969

The affected product is an SFT DAB 600/C, which is a network-connected broadcast appliance. These devices are commonly deployed with web-based management interfaces that are designed to be accessed over a network. Since the vulnerability resides in the userManager API, it is commonly exposed as a network-facing service in its intended deployment context.

Missing Authentication

Dbbroadcast Sft Dab 600\/c Firmware

1.9.3

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in the Screen SFT DAB 600/C firmware that could allow unauthorized access and user password changes. The issue stems from how the system manages user sessions, potentially enabling attackers to bypass authentication controls. Understanding the potential impact on our broadcast operations and systems is key.

Session security issue allows unauthorized access.
Critical systems could be compromised remotely.
Assess relevance and confirm exposure.

Attack Path

How an attacker could exploit the issue

Attackers can bypass authentication controls on the Screen SFT DAB 600/C by exploiting how the device manages user sessions. By reusing an IP address, an attacker can issue unauthorized requests to change user passwords without needing legitimate credentials. This could lead to unauthorized access and control over the device.

Network access required.
Reusing an IP address triggers vulnerability.
Unauthorized password changes possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker on the same network to change user passwords by reusing an IP address and exploiting session binding. This could affect the confidentiality of user account credentials and the integrity of system access controls.

User account credentials.
Unauthorized access requests.
Compromise of system access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The likely owners of this vulnerability are the teams managing the broadcast infrastructure and potentially the application or platform owners responsible for the SFT DAB 600/C devices. The first critical step is to identify all instances of this firmware, determine their network exposure and business criticality, and then locate the accountable system owner to plan remediation.

Broadcast infrastructure and application owners.
Verify network exposure and criticality.
Plan coordinated firmware updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Screen SFT DAB 600/C?

The Screen SFT DAB 600/C is a network-connected broadcast appliance produced by DB Broadcast. It is commonly used in professional radio environments to facilitate digital audio broadcasting. These devices typically include web-based management interfaces that allow administrators to configure settings and manage system operations over a network.

How does this CVE-2023-53969 vulnerability work?

This is a session management issue, specifically classified as CWE-306: Missing Authentication for Critical Function. The firmware incorrectly validates session tokens by relying on the client's IP address rather than secure, independent authentication credentials. This weakness allows an attacker to interact with the userManager API as if they were a logged-in administrator.

Do I need to be logged in to trigger this bug?

No. An attacker does not need prior authentication or valid credentials to trigger this vulnerability. The attack path involves manipulating requests to the device by reusing an IP address associated with a session. Note that simply communicating with the device over the network is the primary requirement; actions that do not target the userManager API or involve authorized session spoofing do not trigger this specific flaw.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal assesses this as having a high likelihood of risk because the SFT DAB 600/C is inherently a network-connected appliance. These devices are frequently deployed with their management interfaces exposed to the network to support remote administration. If your device is accessible via a network—especially if reachable beyond a restricted local segment—it falls within the potential scope of this issue.

What should I do if I run this technology?

Begin by creating an inventory of all SFT DAB 600/C units in your environment and confirming their current firmware versions. Assess which devices are accessible over your network and evaluate their business criticality. Once mapped, coordinate with your broadcast infrastructure team to identify and apply the latest firmware updates provided by the manufacturer to close the authentication gap.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.