CVE-2023-53740

Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without providing the current credentials. Attackers can exploit the userManager.cgx endpoint by sending a crafted JSON request with a new MD5-hashed password to directly modify the admin account.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.dbbroadcast.com	Product
https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/	Product
https://www.exploit-db.com/exploits/51458	Exploit Third Party Advisory
https://www.screen.it	Product
https://www.vulncheck.com/advisories/screen-sft-dab-authentication-bypass-via-admin-password-change	Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5774.php	Third Party Advisory Exploit
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5774.php	Third Party Advisory Exploit

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:dbbroadcast:sft_dab_015\/c_firmware:1.9.3:*:*:*:*:*:*:*

cpe:2.3:h:dbbroadcast:sft_dab_015\/c:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:dbbroadcast:sft_dab_050\/c_firmware:1.9.3:*:*:*:*:*:*:*

cpe:2.3:h:dbbroadcast:sft_dab_050\/c:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:dbbroadcast:sft_dab_150\/c_firmware:1.9.3:*:*:*:*:*:*:*

cpe:2.3:h:dbbroadcast:sft_dab_150\/c:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:dbbroadcast:sft_dab_300\/c_firmware:1.9.3:*:*:*:*:*:*:*

cpe:2.3:h:dbbroadcast:sft_dab_300\/c:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:dbbroadcast:sft_dab_600\/c_firmware:1.9.3:*:*:*:*:*:*:*

cpe:2.3:h:dbbroadcast:sft_dab_600\/c:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-12-10 21:16

Updated : 2025-12-17 18:59

NVD link : CVE-2023-53740

Mitre link : CVE-2023-53740

CVE.ORG link : CVE-2023-53740

JSON object : View

Products Affected

dbbroadcast

sft_dab_300\/c_firmware
sft_dab_015\/c
sft_dab_050\/c
sft_dab_600\/c_firmware
sft_dab_150\/c
sft_dab_015\/c_firmware
sft_dab_050\/c_firmware
sft_dab_150\/c_firmware
sft_dab_300\/c
sft_dab_600\/c

CWE

CWE-862

Missing Authorization

{"id": "CVE-2023-53740", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-12-10T21:16:03.233", "references": [{"url": "https://www.dbbroadcast.com", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/51458", "tags": ["Exploit", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.screen.it", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/screen-sft-dab-authentication-bypass-via-admin-password-change", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5774.php", "tags": ["Third Party Advisory", "Exploit"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5774.php", "tags": ["Third Party Advisory", "Exploit"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without providing the current credentials. Attackers can exploit the userManager.cgx endpoint by sending a crafted JSON request with a new MD5-hashed password to directly modify the admin account."}], "lastModified": "2025-12-17T18:59:09.727", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dbbroadcast:sft_dab_015\\/c_firmware:1.9.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0EE37C7E-291F-45C3-BB2E-86C9A7F39208"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dbbroadcast:sft_dab_015\\/c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9BD8A6C5-36B7-4163-824B-32DAC7AEC701"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dbbroadcast:sft_dab_050\\/c_firmware:1.9.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE43E31F-976D-420F-BF89-04F071998703"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dbbroadcast:sft_dab_050\\/c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BD0400E2-2D22-4323-A2B3-96CC2CA228FF"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dbbroadcast:sft_dab_150\\/c_firmware:1.9.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA97FA0A-3503-4A79-8170-7873A57917D0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dbbroadcast:sft_dab_150\\/c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F2D8D14D-C6F4-43CA-A688-AF9F4522F123"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dbbroadcast:sft_dab_300\\/c_firmware:1.9.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "427DE942-7268-4054-967A-B2FA28AC8FCB"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dbbroadcast:sft_dab_300\\/c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7C9BA369-3D1D-4AFA-8C53-1D0B1BD4A365"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dbbroadcast:sft_dab_600\\/c_firmware:1.9.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B51EAD42-9B3F-44D5-973A-4758498D1339"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dbbroadcast:sft_dab_600\\/c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "97E91C9F-B55C-4B1A-BE03-D1F03AC90FE5"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "disclosure@vulncheck.com"}