Published: 2025-11-14T23:15:43.640
Overview
CVE-2023-7328 details a significant security vulnerability affecting Screen SFT DAB 600/C firmware versions up to and including 1.9.3. This vulnerability stems from an improper access control on the user management API, enabling unauthenticated attackers to retrieve sensitive user data. This data includes account names and connection metadata, such as client IP addresses and timeout values. This exposure can have serious consequences for the security and privacy of users of the affected devices.
Technical Details
The vulnerability lies in the insufficient access control mechanisms implemented for the user management API. An attacker can directly query the API endpoints responsible for managing user accounts without providing any authentication credentials. This bypass allows the attacker to obtain a structured dump of user data, revealing critical information that could be used for further malicious activities.
CVSS Analysis
While the CVE entry currently lists the severity as N/A and the CVSS score as N/A, the impact of this vulnerability should not be underestimated. The ability to retrieve user data without authentication is a significant security flaw. A proper CVSS score would likely place this vulnerability in the Medium to High severity range, depending on the specifics of the exposed data and the ease of exploitation.
Possible Impact
The exploitation of CVE-2023-7328 can lead to several adverse consequences:
- Account enumeration: Attackers can identify valid user accounts.
- Information disclosure: Sensitive connection metadata, such as client IP addresses, is exposed, potentially revealing the network locations of users.
- Credential harvesting: While not explicitly stated, the disclosed information may assist in attempts to guess or crack user passwords.
- Denial of service: Attackers could potentially leverage the disclosed information to perform targeted denial-of-service attacks.
- Lateral movement: In some network configurations, client IP addresses might be used to attempt lateral movement to other devices on the network.
Mitigation or Patch Steps
The primary mitigation strategy is to update the Screen SFT DAB 600/C firmware to a version that addresses this vulnerability. Contact DB Broadcast to inquire about available firmware updates.
Workarounds (if a patch is not immediately available):
- Isolate the Screen SFT DAB 600/C device behind a firewall and restrict access to the device’s management interface to trusted networks only.
- Monitor network traffic to and from the device for any suspicious activity.
References
Packet Storm Security – CVE-2023-7328
DB Broadcast – SFT DAB Series Compact Air
Exploit-DB – CVE-2023-7328
VulnCheck Advisory – Screen SFT DAB 600/C Unauthenticated Information Disclosure
Zero Science Lab – ZSL-2023-5776
