CVE-2023-53740
Critical
Description
Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without providing the current credentials. Attackers can exploit the userManager.cgx endpoint by sending a crafted JSON request with a new MD5-hashed password to directly modify the admin account.
SeverityCritical
CVSS9.8
Exploit probability—
ProductDbbroadcast Sft Dab 015\/c Firmware
PublishedDec 10, 2025
First seenDec 10, 2025
Weakness typeCWE-862Missing authorization
How to fix
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dbbroadcast sft_dab_015\/c_firmware | 1.9.3 | — |
| dbbroadcast sft_dab_050\/c_firmware | 1.9.3 | — |
| dbbroadcast sft_dab_150\/c_firmware | 1.9.3 | — |
| dbbroadcast sft_dab_300\/c_firmware | 1.9.3 | — |
| dbbroadcast sft_dab_600\/c_firmware | 1.9.3 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.