Screen SFT DAB 600/C <= 1.9.3 Unauthenticated Information Disclosure

Advisories

severity: medium
date: November 14, 2025
Affecting: Screen SFT DAB 600/C <= 1.9.3
An affected version range remains undefined
CVE: CVE-2023-7328
CWE: CWE-306 Missing Authentication for Critical Function
CVSS: 6.9
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References: Zero Science Lab Disclosure (ZSL-2023-5776)
ExploitDB-51460
Packet Storm Security (#172332)
SFT DAB Product Site
Credit: Gjoko Krstic of Zero Science Lab
Description: Screen SFT DAB 600/C firmware versions up to and including 1.9.3 contain an improper access control on the user management API allows unauthenticated requests to retrieve structured user data, including account names and connection metadata such as client IP and timeout values.