CVE-2023-53967
📋 TL;DR
This authentication bypass vulnerability in Screen SFT DAB 600/C firmware allows attackers to change the admin password without providing current credentials. Attackers can exploit the userManager.cgx API endpoint via crafted POST requests to modify authentication. All users of affected firmware versions are vulnerable to unauthorized administrative access.
💻 Affected Systems
- Screen SFT DAB 600/C
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to reconfigure broadcast settings, disrupt operations, or use the device as an attack pivot point into broadcast networks.
Likely Case
Unauthorized administrative access leading to configuration changes, service disruption, or data exfiltration from the device.
If Mitigated
Limited impact if device is isolated in protected network segments with strict access controls and monitoring.
🎯 Exploit Status
Exploit requires simple HTTP POST request to userManager.cgx endpoint with MD5-hashed password. Public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.dbbroadcast.com
Restart Required: No
Instructions:
Check vendor website for firmware updates. If available, download latest firmware and follow vendor's update procedure.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected devices in separate VLANs with strict firewall rules blocking external access to management interfaces.
Access Control Lists
allImplement IP-based restrictions to only allow administrative access from trusted management networks.
🧯 If You Can't Patch
- Disable web management interface if not required for operations
- Implement network monitoring for suspicious POST requests to userManager.cgx endpoint
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or SSH. If version is 1.9.3 or earlier, assume vulnerable.Check Version:
Check web interface System Information page or use vendor-specific CLI commandsVerify Fix Applied:
Test if password change via userManager.cgx endpoint still works without authentication after applying vendor patch.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /userManager.cgx
- Failed authentication attempts followed by successful password changes
- Unusual admin account modifications
Network Indicators:
- HTTP traffic to device management interface containing password change parameters
- POST requests to userManager.cgx from unexpected sources
SIEM Query:
source="device_logs" AND (uri="/userManager.cgx" OR event="password_change")🔗 References
- https://www.dbbroadcast.com
- https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/
- https://www.exploit-db.com/exploits/51458
- https://www.vulncheck.com/advisories/screen-sft-dab-c-firmware-authentication-bypass-admin-password-change
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5774.php
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5774.php
