Auth bypass in Dbbroadcast Sft Dab 015\/c
CVE-2023-53740
Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without providing the current credentials. Attackers can exploit the userManager.cgx endpoint by sending a crafted JSON request with a new MD5-hashed password to directly modify the admin account.
Vulnerability class: Broken Access Control
EPSS: 0.008 (54.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Dbbroadcast Sft_dab_015\/c
- Dbbroadcast Sft_dab_015\/c_firmware — versions 1.9.3
- Dbbroadcast Sft_dab_050\/c
- Dbbroadcast Sft_dab_050\/c_firmware — versions 1.9.3
- Dbbroadcast Sft_dab_150\/c
- Dbbroadcast Sft_dab_150\/c_firmware — versions 1.9.3
- Dbbroadcast Sft_dab_300\/c
- Dbbroadcast Sft_dab_300\/c_firmware — versions 1.9.3
- Dbbroadcast Sft_dab_600\/c
- Dbbroadcast Sft_dab_600\/c_firmware — versions 1.9.3
Weakness classification (CWE)
References
- disclosure@vulncheck.com (Exploit, Third Party Advisory, exploit)
- disclosure@vulncheck.com (Product, product)
- disclosure@vulncheck.com (Product, product)
- disclosure@vulncheck.com (Product, vendor-advisory, vdb-entry)
- disclosure@vulncheck.com (Exploit, vendor-advisory, Third Party Advisory, vdb-entry)
- disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2023-53740?
- CVE-2023-53740 is a critical-severity vulnerability in Dbbroadcast Sft Dab 015\/c, classified under Missing Authorization. CVSS score: 9.8/10. Published 2025-12-10.
- How severe is CVE-2023-53740?
- Critical severity. CVSS v3 base score is 9.8 out of 10.