CVE-2023-53967 is a critical vulnerability identified in the Screen SFT DAB 600/C device firmware version 1.9.3, produced by DB Elettronica Telecomunicazioni SpA. The vulnerability arises from a missing authentication mechanism on a critical function within the device’s API, specifically the userManager.cgx endpoint. This endpoint allows modification of the administrator password by accepting a POST request containing a new password hashed with MD5. Due to the lack of authentication checks, an attacker can send a crafted request remotely without any credentials, privileges, or user interaction to overwrite the admin password. This effectively grants full administrative access to the device, compromising its confidentiality, integrity, and availability. The CVSS 4.0 base score of 9.3 reflects the high severity, with attack vector being network (AV:N), low attack complexity (AC:L), no authentication required (AT:N), and no user interaction (UI:N). The vulnerability impacts the security posture of organizations relying on this telecom equipment, as attackers could manipulate device configurations, intercept or disrupt communications, or pivot within internal networks. No patches or exploits are currently publicly known, but the risk remains critical given the ease of exploitation and potential impact on telecom infrastructure.

For European organizations, especially those in telecommunications, critical infrastructure, and government sectors, this vulnerability poses a severe risk. Exploitation could lead to unauthorized administrative control over telecom devices, enabling attackers to alter configurations, intercept sensitive communications, disrupt services, or use the compromised device as a foothold for further network intrusion. This could result in significant operational disruptions, data breaches, and loss of trust. Given the device’s role in telecom infrastructure, the impact extends to service availability and national security concerns. Organizations may face regulatory and compliance repercussions if the vulnerability leads to data exposure or service outages. The lack of authentication requirement and remote exploitability increases the likelihood of attacks, particularly in environments where these devices are accessible from less secure network segments or exposed to the internet.

1. Immediate action should focus on obtaining and applying firmware updates or patches from DB Elettronica Telecomunicazioni SpA once available. 2. Until patches are released, restrict network access to the userManager.cgx API endpoint by implementing strict firewall rules and network segmentation to isolate the vulnerable devices from untrusted networks. 3. Employ VPNs or secure management networks for administrative access to these devices to prevent unauthorized remote access. 4. Monitor network traffic for unusual POST requests targeting the userManager.cgx endpoint, using intrusion detection/prevention systems (IDS/IPS) and SIEM solutions to detect exploitation attempts. 5. Enforce strong physical security controls to prevent local access to devices. 6. Conduct regular audits of device configurations and access logs to identify unauthorized changes. 7. Educate network administrators about the vulnerability and ensure they follow secure password management practices. 8. Consider deploying compensating controls such as multi-factor authentication on management interfaces if supported by the device firmware.