Vulnerability · Published Nov 14, 2025 · Assigned by VulnCheck
CVE-2023-7328Screen SFT DAB 600/C <= 1.9.3 Unauthenticated Information Disclosure
Medium 6.9
In plain English
A medium-severity missing authentication in Screen SFT DAB 600/C from DB Elettronica Telecomunicazioni SpA. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.4%top 68.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Screen SFT DAB 600/C firmware versions up to and including 1.9.3 contain an improper access control on the user management API allows unauthenticated requests to retrieve structured user data, including account names and connection metadata such as client IP and timeout values.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| DB Elettronica Telecomunicazioni SpA | Screen SFT DAB 600/C | 0 – through 1.9.3 |
Weakness: CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://www.exploit-db.com/exploits/51460 exploit
- https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/ product
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5776.php technical-description, exploit
- https://packetstormsecurity.com/files/172332/ exploit
- https://www.vulncheck.com/advisories/screen-sft-dab-600c-unauthenticated-information-disclosure third-party-advisory