CVE-2023-7328

Screen SFT DAB 600/C firmware versions up to and including 1.9.3 contain an improper access control on the user management API allows unauthenticated requests to retrieve structured user data, including account names and connection metadata such as client IP and timeout values.

Score

CVSS 4.0 6.9 Medium

Status

Analyzed - disclosure@vulncheck.com

Published

2025-11-14

Last modified

2026-04-07

Weaknesses

CWE-306

Affected products

• Screen Sft Dab 600c (Db Elettronica)
• Sft Dab 600/c Firmware (Dbbroadcast)

References

• https://packetstormsecurity.com/files/172332/
• https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/
• https://www.exploit-db.com/exploits/51460
• https://www.vulncheck.com/advisories/screen-sft-dab-600c-unauthenticated-information-disclosure
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5776.php