CVE-2023-7328

Screen SFT DAB 600/C firmware versions up to and including 1.9.3 contain an improper access control on the user management API allows unauthenticated requests to retrieve structured user data, including account names and connection metadata such as client IP and timeout values.

CVSS

No CVSS.

References

Link	Resource
https://packetstormsecurity.com/files/172332/
https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/
https://www.exploit-db.com/exploits/51460
https://www.vulncheck.com/advisories/screen-sft-dab-600c-unauthenticated-information-disclosure
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5776.php
https://www.exploit-db.com/exploits/51460
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5776.php

Configurations

No configuration.

History

18 Nov 2025, 17:15

Type	Values Removed	Values Added
References	~~() https://www.exploit-db.com/exploits/51460 -~~	() https://www.exploit-db.com/exploits/51460 -
References	~~() https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5776.php -~~	() https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5776.php -

14 Nov 2025, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-11-14 23:15

Updated : 2025-11-18 17:15

NVD link : CVE-2023-7328

Mitre link : CVE-2023-7328

CVE.ORG link : CVE-2023-7328

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2023-7328", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-11-14T23:15:43.640", "references": [{"url": "https://packetstormsecurity.com/files/172332/", "source": "[email protected]"}, {"url": "https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/", "source": "[email protected]"}, {"url": "https://www.exploit-db.com/exploits/51460", "source": "[email protected]"}, {"url": "https://www.vulncheck.com/advisories/screen-sft-dab-600c-unauthenticated-information-disclosure", "source": "[email protected]"}, {"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5776.php", "source": "[email protected]"}, {"url": "https://www.exploit-db.com/exploits/51460", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5776.php", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Screen SFT DAB 600/C firmware versions up to and including 1.9.3 contain an improper access control on the user management API allows unauthenticated requests to retrieve structured user data, including account names and connection metadata such as client IP and timeout values."}], "lastModified": "2025-11-18T17:15:57.660", "sourceIdentifier": "[email protected]"}