CVE-2023-53740 is a critical authentication bypass (CVSS 9.8) in Screen SFT DAB 1.9.3, a DAB radio broadcast device. The userManager.cgx endpoint accepts a new admin password without checking the current one. No fixed version is confirmed, so restrict network access and contact the vendor.
What's affected
The CVE record lists Screen SFT DAB 1.9.3 and names the SFT DAB 015/C, 050/C, 150/C and 300/C devices and their firmware, sold under the dBBroadcast brand. The description says an attacker can change the admin password without providing the current credentials by sending a request to the userManager.cgx endpoint.
I could not confirm a fixed version from the sources available, so check the vendor site and release notes for a newer release. The record links a public exploit listing and a researcher advisory from Zero Science Lab, so details about the weakness are public.
How to check if you're exposed
Log in to the device's web interface and read the firmware version on the status or about page. Version 1.9.3 is the version named in the record. Earlier versions may be affected too, and the record does not say.
Then check exposure, which matters more than the version number for gear like this. Broadcast transmitter and encoder devices are often put on a network quickly, with a public address for remote access. From outside your network, test whether the device web interface answers. If it does, that is the first thing to fix.
Also check that the admin password still works. A password that was changed without your knowledge is the clearest sign of abuse, and the record describes exactly that outcome.
What to do now
- Find every SFT DAB device on your networks, including remote transmitter sites.
- Remove the device web interface from the internet. Use a VPN or an allow list for remote administration.
- Put the devices on a separate management network with firewall rules that name the admin hosts.
- Contact the vendor for a fixed firmware version, and apply it when available.
- Verify that the admin password and device configuration are what you expect, and record the settings so a change stands out.
Why it matters
The weakness is missing authorization (CWE-862). A function that changes the admin password should check that the caller is already authenticated, and ideally that they know the current password. Here the endpoint accepts the change without either check, so anyone who can reach it can take the device over.
Broadcast equipment is operational technology in a public facing setting. Control of the admin account lets an attacker change the device settings and lock the real owner out. The record does not say the issue is exploited in the wild, and the CVE is not on the CISA Known Exploited Vulnerabilities list, but a public exploit listing is linked, so unpatched devices on the internet deserve attention now.
Quick check
Is there a fixed firmware?
I could not confirm one. Ask the vendor, and meanwhile keep the device off the internet.
What is the quickest risk reduction?
Remove public access to the web interface and restrict it to a management network.
Sources
Last reviewed: 19 October 2026.
