Description
Screen SFT DAB 600/C Firmware 1.9.3 contains a weak session management vulnerability that allows attackers to bypass authentication controls by reusing IP-bound session identifiers. Attackers can exploit the vulnerable deviceManagement API endpoint to reset device configurations by sending crafted POST requests with manipulated session parameters.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| DB Elettronica Telecomunicazioni SpA | Screen SFT DAB 600/C | - | — |
References
- ExploitDB-51459 exploit
- DB Elettronica Telecomunicazioni Product Homepage product
- SFT DAB Series Product Page product
- Zero Science Lab Disclosure (ZSL-2022-5775) third-party-advisory
- VulnCheck Advisory: Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Reset Board Config third-party-advisory