CVE-2023-53740
Screen SFT DAB 1.9.3 Authentication Bypass via Admin Password Change
- State
- Published
- Severity
- 8.6 High
- Published
- Dec 10, 2025
- Updated
- Apr 7, 2026
- Reserved
- Dec 7, 2025
Description
Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without providing the current credentials. Attackers can exploit the userManager.cgx endpoint by sending a crafted JSON request with a new MD5-hashed password to directly modify the admin account.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
Screen SFT DAB Series - Compact Radio DAB TransmitterDB Elettronica Telecomunicazioni SpA |
|
References
- ExploitDB-51458exploit
- Product Homepageproduct
- Official Product Homepageproduct
- Vendor Homepagevendor-advisoryvdb-entry
- Advisory URLvendor-advisoryvdb-entry
- VulnCheck Advisory: Screen SFT DAB 1.9.3 Authentication Bypass via Admin Password Changethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.