PT-2025-50524 · Unknown · Screen Sft Dab

Published 2025-12-10 · Updated 2025-12-11 · CVE-2023-53740

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Screen SFT DAB version 1.9.3

Description Screen SFT DAB 1.9.3 contains a flaw that allows attackers to bypass authentication and modify the administrator password without knowing the existing credentials. Exploitation involves sending a specially crafted JSON request to the userManager.cgx API endpoint. The request includes a new MD5-hashed password, which directly alters the admin account.

Recommendations Apply a fix to address the authentication bypass in the userManager.cgx endpoint.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-53740

Affected Products

Screen Sft Dab

References · 10

• 🔥 https://exploit-db.com/exploits/51458 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2023-5774.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-53740 · Security Note
• https://dbbroadcast.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-53740 · Vendor Advisory
• https://twitter.com/CVEnew/status/1999108922444226665 · Twitter Post
• https://t.me/CVEtracker/39408 · Telegram Post
• https://screen.it · Note
• https://dbbroadcast.com/products/radio/sft-dab-series-compact-air · Note
• https://vulncheck.com/advisories/screen-sft-dab-authentication-bypass-via-admin-password-change · Note