Vulnerability · Published Dec 22, 2025 · Assigned by VulnCheck

CVE-2023-53967Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Admin Password Change

High 7.5

In plain English

A high-severity missing authentication in Screen SFT DAB 600/C from DB Elettronica Telecomunicazioni SpA. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 56.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Screen SFT DAB 600/C firmware 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without requiring the current credentials. Attackers can exploit the userManager.cgx API endpoint by sending a crafted POST request with a new MD5-hashed password to directly modify the admin account's authentication.

Affected products (as reported)

Vendor	Product	Versions
DB Elettronica Telecomunicazioni SpA	Screen SFT DAB 600/C	-

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

ExploitDB-51458 exploit
DB Elettronica Telecomunicazioni SpA Homepage product
SFT DAB Series Product Page product
Zero Science Lab Disclosure (ZSL-2022-5774) third-party-advisory
VulnCheck Advisory: Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Admin Password Change third-party-advisory