An authentication bypass vulnerability in the Screen SFT DAB 600/C firmware allows unauthenticated attackers to gain administrative control by resetting the system password.

This flaw exists due to missing authentication checks on the userManager.cgx API endpoint, which allows an unauthenticated attacker to invoke the changeUserPswd function. By sending a crafted POST request containing a new MD5-hashed password, an attacker can overwrite the existing administrator credentials without prior knowledge of the current password.

The ability to arbitrarily change the administrator password results in a total loss of confidentiality, integrity, and availability for the affected transmitter. Given the critical nature of broadcast infrastructure, unauthorized access could lead to service disruption, manipulation of transmitted content, or the permanent lockout of legitimate administrators. With a CVSS score of 7.5, this vulnerability represents a high-severity risk that requires immediate attention to prevent full system compromise.

Immediate Action: Contact DB Elettronica Telecomunicazioni SpA support to obtain the latest firmware update that addresses this authentication bypass. If an update is not immediately available, isolate the transmitter from public-facing networks to prevent remote exploitation.

Proactive Monitoring: Review device access logs for unauthorized POST requests directed at the /system/api/userManager.cgx endpoint. Monitor for any unexpected changes to administrative accounts or configuration parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) or equivalent network access control list to restrict access to the device management interface, ensuring only authorized management IP addresses can communicate with the API.

Public Exploit Available: Yes, a functional exploit script is available on Exploit-DB (EDB-ID 51458).

Given the availability of a public exploit and the ease of triggering this vulnerability via the API, the risk of unauthorized administrative access is significant. Security teams must treat this as a high-priority concern and apply the vendor-supplied patch immediately. If patching is not feasible, strict network segmentation is essential to mitigate the risk posed by the unauthenticated nature of this attack.