What’s Vulnerable › Vulnerabilities

CVE-2023-53740: Screen SFT DAB 1.9.3 Authentication Bypass via Admin Password Change

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-10 · updated 2026-06-17
• Weakness: CWE-862

Description

Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without providing the current credentials. Attackers can exploit the userManager.cgx endpoint by sending a crafted JSON request with a new MD5-hashed password to directly modify the admin account.

Affected products

• Dbbroadcast Sft Dab 015/C Firmware: 1.9.3
• Dbbroadcast Sft Dab 050/C Firmware: 1.9.3
• Dbbroadcast Sft Dab 150/C Firmware: 1.9.3
• Dbbroadcast Sft Dab 300/C Firmware: 1.9.3
• DB Elettronica Telecomunicazioni SpA Screen SFT DAB 600/C: 1.9.3

References

• https://www.dbbroadcast.com
• https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/
• https://www.exploit-db.com/exploits/51458
• https://www.screen.it
• https://www.vulncheck.com/advisories/screen-sft-dab-authentication-bypass-via-admin-password-change
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5774.php
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5774.php

Get alerted when CVE-2023-53740 or the next vulnerability affects your stack