Auth bypass in Dbbroadcast Sft Dab 015\/c
CVE-2023-53740
Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without providing the current credentials. Attackers can exploit the userManager.cgx endpoint by sending a crafted JSON request with a new MD5-hashed password to directly modify the admin account.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.009 (57.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 58th percentile — 57.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: -0.000
Affected products
- Dbbroadcast Sft Dab 015\/c
- Dbbroadcast Sft Dab 015\/c Firmware — versions 1.9.3
- Dbbroadcast Sft Dab 050\/c
- Dbbroadcast Sft Dab 050\/c Firmware — versions 1.9.3
- Dbbroadcast Sft Dab 150\/c
- Dbbroadcast Sft Dab 150\/c Firmware — versions 1.9.3
- Dbbroadcast Sft Dab 300\/c
- Dbbroadcast Sft Dab 300\/c Firmware — versions 1.9.3
- Dbbroadcast Sft Dab 600\/c
- Dbbroadcast Sft Dab 600\/c Firmware — versions 1.9.3
Weakness classification (CWE)
References
- www.exploit-db.com/exploits/51458 (Exploit, Third Party Advisory, exploit)
- www.screen.it (Product, product)
- www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/ (Product, product)
- www.dbbroadcast.com (Product, vendor-advisory, vdb-entry)
- www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5774.php (Exploit, vendor-advisory, Third Party Advisory, vdb-entry)
- www.vulncheck.com/advisories/screen-sft-dab-authentication-bypass-via-admin-pas… (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2023-53740?
- CVE-2023-53740 is a critical-severity vulnerability in Dbbroadcast Sft Dab 015\/c, classified under Missing Authorization. CVSS score: 9.8/10. Published 2025-12-10.
- How severe is CVE-2023-53740?
- Critical severity. CVSS v3 base score is 9.8 out of 10.